02:10 Saturday, 300 Endpoints Down

First action: cut the outbound command-and-control channel and disable the vendor credential - before any restoration.

Everything else waits on this. While the C2 channel is live, the adversary retains interactive access, can watch the recovery, and can re-encrypt or destroy the very backups the MD wants to restore from. Specifically:

• Block the destination at egress, and hunt for other beaconing from the same estate rather than assuming one IP.
• Disable and re-issue the vendor account, and identify every other account and system that vendor touched.
• Isolate the encrypted segments while preserving the EDR telemetry feed - do not blanket-disconnect the network from the tooling that is producing evidence.

Why it is contentious: it directly contradicts the MD's instruction to start restoring. It also costs time - every hour spent isolating is an hour of production lost, and the MD owns that number. The CISO's job here is to make the conflict explicit: restoration begun under an active adversary is not faster, it is the same restoration followed by a second incident, and this time the attacker knows your recovery plan.

Second, immediately: treat the backup repository as suspect. Hourly replication to the same site means the retention window may already contain encrypted or tampered restore points. Verify the offline/immutable copy exists before promising the MD a recovery time - that promise is the real decision point.

Window	Action	Owner
0–2h	Egress block; disable vendor credential; hunt for persistence (scheduled tasks, services, new admin accounts, domain-level changes)	IR lead + network
0–2h	Notify cyber insurer, breach counsel, and confirm privilege/confidentiality of the investigation; open the incident log	CISO + legal
2–4h	Capture volatile evidence from the known-compromised host (memory, running processes, EDR export) before rebuild	Forensics
2–6h	Validate the offline/immutable backup in an isolated environment - restore to a clean test network and confirm data integrity and date	Backup/ops lead
4–8h	Rebuild rather than decrypt: reimage affected endpoints from known-good images, rotate all credentials that were on compromised hosts, reset the vendor's credentials	IT ops
6–12h	Restore priority systems in dependency order - ERP and inventory/ordering first, supporting services after	Ops lead + business
throughout	Preserve the timeline for the notification decision; log every action with a timestamp and actor	Forensics

Two judgement points to state aloud:

1. Rebuild over decrypt. Paying or using a decryptor is justified only as a last resort after backups are proven unusable - and the vendor's decryptors frequently produce partially corrupt data. Payer status is a legal/business decision, not an IT one, and it does not remove the need to find and eliminate the persistence anyway.
2. Do not restore into a network that still has adversary access. The validation and eradication gates are not optional steps that the Monday deadline can compress.

Not the CISO's to make:

• Stopping or resuming business operations. That is the MD's (and above, the group's) decision, taken on the basis of a risk assessment the CISO supplies. The CISO's duty is to make the consequence of starting early legible: re-introduction of the adversary, loss of evidence, and a second incident with no backups.
• Notification, which is a legal determination with statutory clocks keyed to discovery in the relevant jurisdictions. Counsel decides the obligation and timing; the CISO supplies facts. Guessing at a notification deadline is as damaging as missing it.
• Whether to pay. Sanctions exposure, insurance and regulator considerations - legal, board and insurer.
• Scope of the forensic investigation, once counsel has retained a firm; the CISO is a stakeholder, not the director.
• Liability statements to customers, vendors, or regulators.

What goes wrong if the CISO overreaches:

• Restoring to satisfy the MD without eradication turns one incident into two, and the second one is unrecoverable because the backups have been overwritten by the attacker's access.
• Personally deciding not to notify creates individual and corporate liability and destroys legal privilege claims.
• Making a containment choice for operational convenience without recording the trade-off means the post-incident review cannot distinguish judgement from negligence.

The correct posture: the CISO owns the technical containment, eradication, evidence integrity, and the honest picture of risk. Everything else is a recommendation, documented in writing, with the decision attributed to the person with the authority to make it.