Ransomware at a Newly Acquired Subsidiary
At 02:10 on a Saturday, ransomware encrypts 60% of file servers at a recently acquired subsidiary in another region. The subsidiary CEO wants to pay the ransom because backups for the subsidiary were never tested after acquisition, and the parent's incident response plan assigns payment decision authority to the parent CISO. The parent CISO is unreachable for four hours. The ransom note demands payment in 48 hours; the subsidiary has 8,000 customers and 1,100 employees. The regulatory notification deadline is 72 hours in the subsidiary's jurisdiction. The parent's cyber insurance policy requires pre-approval for ransom payments and covers negotiation costs. The subsidiary's IT team has isolated two segments, but the domain controller is encrypted. The parent has a contract IR retainer with a 4-hour SLA that was not invoked. The subsidiary's CEO has already contacted a ransom negotiator independently.
1. Who has authority to decide on payment, and how should the program manager handle the conflict?
Read the worked answer
The parent incident response plan assigns payment authority to the parent CISO; the subsidiary CEO cannot unilaterally pay. The program manager's job is to activate governance: invoke the retainer, contact the parent CISO's designated alternate, and convene the crisis management team. If the CISO is truly unreachable, follow the plan's delegation clause rather than allowing the subsidiary to improvise. Payment decisions require legal review, insurance pre-approval, sanctions screening, and law-enforcement consultation; a ransom negotiator hired independently may create legal and insurance problems. The program manager should not make the payment call personally but should ensure the right decision-maker is engaged and the decision is documented. The reasoning: paying may violate sanctions, fund criminal activity, and does not guarantee recovery, while insurance may deny coverage without pre-approval. The subsidiary CEO's urgency is understandable, but authority and process matter most under stress.
2. What immediate sequence and notifications should the program manager drive?
Read the worked answer
Immediate sequence: invoke the retainer and isolate remaining segments; preserve evidence and determine whether the domain controller can be rebuilt; assess backup integrity and restore critical services; start the 72-hour regulatory notification analysis with legal; notify the insurer and seek pre-approval before any negotiation; brief the parent executive team and board; and coordinate with the subsidiary CEO on customer and employee communications. Do not let the independent negotiator act without authorization. The program manager should run a decision log with timestamps. The reasoning: containment first, then legal and regulatory obligations, then recovery; payment is a last resort and only with approvals. The 4-hour retainer SLA should have been invoked at 02:10, so the delay is itself a finding. This sequence also preserves insurance coverage and avoids irreversible actions before facts are established.
3. What governance gaps does this incident reveal, and what should be fixed?
Read the worked answer
Gaps: subsidiary backups were untested after acquisition; there is no integrated incident response plan or delegated authority; the retainer was not invoked; the insurance pre-approval process was not socialized; and the subsidiary CEO bypassed governance. Fixes: add the subsidiary to the parent incident response plan with named alternates, test backups quarterly, pre-clear a ransom decision framework and insurer contacts, run a joint tabletop, and define communication protocols. The program manager should also review M&A integration checklists to include incident response and backup validation before close, not after. The reasoning: this incident is a governance failure as much as a technical one; the fix is not another policy but tested decision rights, rehearsed escalation, and evidence that the subsidiary can be operated under parent governance during a crisis.