Manufacturing Ransomware Response: First 60 Minutes Playbook

Updated October 02, 2026

TL;DR: In the first 60 minutes of a suspected ransomware attack, a Texas manufacturer declares the incident, isolates affected segments without powering down, notifies its incident response provider and insurance carrier in parallel, and preserves volatile evidence before it disappears. TechProComp’s managed IT services for manufacturing are built around the same 24/7/365 monitoring and incident response support this playbook assumes is already in place. Following it doesn’t require technical expertise, only a documented plan and the discipline to follow it under pressure.

A ransomware attack doesn’t wait for a manufacturer to find its plan. In the first 60 minutes, a Texas manufacturer isolates affected segments without powering down, notifies its response provider, insurance carrier, and legal counsel, and preserves the evidence that proves what happened, using the same managed IT services for manufacturing TechProComp already provides.

That is the job description for the Operations Leader who becomes the de facto incident commander while the IT person handles technical remediation. TechProComp’s 24/7/365 monitoring and incident response support are the foundation this playbook assumes is in place, the same foundation behind a ransomware response plan manufacturing operations leaders can execute the moment an attack starts.

Time Window	Key Actions	Decision Point
0-5 min	Confirm the attack is real, declare the incident, open the response bridge	Real attack or false alarm
5-15 min	Isolate affected segments, don’t power down, call the IR provider and insurance carrier	Isolate versus shut down
15-30 min	Preserve volatile evidence, notify executives, begin scope assessment	What to preserve before it is gone
30-45 min	Assess OT and production impact, begin containment	Continuity versus forensic preservation
45-60 min	Decide on disclosure, confirm the continuity plan, start the communication plan	Who gets told, and when

Prerequisites: What Do You Need Before a Ransomware Attack Hits?

The first 60 minutes only work if the prerequisites exist before the attack starts. A documented plan, a named incident commander, and a signed retainer with a response provider turn chaos into a checklist.

Why Prerequisites Determine the First 60 Minutes

A documented plan is what makes minute 0-5 fast instead of chaotic. Without prerequisites in place before an incident, the Operations Leader spends the first critical minutes finding phone numbers instead of executing steps.

The six items below aren’t paperwork for its own sake. Each one removes a decision that would otherwise have to be made, or a number that would otherwise have to be found, while the clock is already running.

NIST’s incident response guidance calls for organizations to consider designating an incident lead for every incident, a role that has to exist on paper before the incident happens, not get improvised during it. TechProComp’s incident response support and 24/7/365 monitoring are built for this moment: the phone that gets called is already on the notification tree.

The 6 Prerequisites Checklist

Six items belong in the incident response kit before anything happens. Each one turns a decision made under pressure into a lookup instead of an improvisation.

• A documented incident response plan, reviewed at least once a year, so the steps are already written down instead of argued over in the moment.
• A named incident commander, with a backup named too, so the authority to declare the incident and order containment is never in question.
• An incident response provider on retainer, not found for the first time mid-incident, since vetting a new provider under pressure costs the minutes that matter most.
• An executive notification tree, tested twice a year, so the right people get a factual update instead of a phone tree failing under stress.
• A cyber insurance carrier’s 24/7 claims number, confirmed against the cyber insurance compliance checklist, since a claim filed late can put coverage at risk.
• Legal counsel on file, already briefed on ransomware disclosure rules, so questions about disclosure and ransom payment get answered by someone who already knows the regulatory landscape.

TechProComp’s Role in Prerequisite Readiness

TechProComp’s incident response support and 24/7/365 monitoring are built for Texas manufacturers with 80 to 150 employees and typically one in-house IT person, the same profile this playbook assumes. A company that size usually has budget for one IT specialist, not a dedicated incident response team standing by around the clock.

That gap is exactly what TechProComp’s incident response support is built to close. TechProComp’s founder brings 25-plus years in the IT industry to how the company built its incident response support, the kind of field experience behind this playbook’s emphasis on documented steps over improvisation.

Minute 0-5: How Do You Confirm a Ransomware Attack Is Real?

Detection Sources and How to Confirm Them

Four signals typically surface a ransomware attack: an EDR alert, an employee report of strange file behavior, a sudden change in file extensions across shared drives, and a ransom note appearing on a desktop or shared folder. Each one needs a short confirmation step before anyone declares an incident.

An EDR alert gets confirmed by checking whether the flagged process matches known ransomware behavior, not just an unusual login. Tracking the earlier signs of ransomware risk matters as much as the moment of confirmation, since early warning signs can surface before anyone has to declare an incident.

Declare the Incident and Kick Off the Response Bridge

Once detection is confirmed, the named incident commander declares the incident out loud, not by email. That single sentence, “we have a confirmed ransomware incident,” starts the clock and opens the response bridge, the call or chat channel where the incident commander, the IT person, and the incident response provider stay connected for the next several hours.

Declaring late costs minutes that can’t be recovered later in the timeline.

Why False-Alarm Discipline Matters

Not every EDR alert or employee report is a ransomware attack. A false alarm treated like a real incident wastes the incident response provider’s time and can erode trust in the process for the next real event, making the team slower to react the next time a real alert comes in.

EDR alerts, employee reports, file-extension changes, and ransom notes exist to separate a false alarm from a confirmed incident before the response bridge opens, so the team reacts to evidence instead of panic.

Minute 5-15: Should You Shut Down Infected Computers?

Isolate Affected Segments

The answer is isolate, not shut down. Disconnecting the affected network segment, pulling the network cable, disabling WiFi, or blocking the segment at the switch, stops the ransomware from spreading without destroying what is running in memory. Whichever method is fastest for a given device is the right one, since the goal at minute 5-15 is speed, not elegance.

Why You Should Not Power Down

Powering down an infected host is the most common reflexive mistake in a ransomware response. CISA’s #StopRansomware Guide recommends isolating affected systems rather than shutting them down, reserving power-down for devices that can’t be disconnected any other way.

Skipping isolation for a shutdown “will prevent your organization from maintaining ransomware infection artifacts and potential evidence stored in volatile memory,” evidence an insurer or law enforcement often needs to confirm what happened. That evidence, once lost, can’t be recreated later no matter how thorough the rest of the response is.

TechProComp’s service level and responsiveness are impressive. The team is responsive, communicative, and willing to work after hours to fix issues. – Keith Kelley on Clutch

Call the IR Provider and Insurance Carrier in Parallel

Call the incident response provider and the insurance carrier at the same time, not one after the other. Sequential calls waste minutes that parallel calls don’t, and those minutes are the ones that determine how much volatile evidence survives to the next step.

Minute 15-30: How Do You Preserve Evidence and Notify Executives?

Preserve Volatile Evidence

System memory, security logs, and firewall log buffers disappear the moment a machine reboots or a log rotates. CISA’s guidance is specific about what to capture: preserve evidence that is “highly volatile in nature” or “limited in retention” to prevent loss or tampering, naming system memory, Windows Security logs, and firewall log buffers directly.

TechProComp’s Endpoint Detection and Response service and 24/7/365 monitoring are built to have this telemetry already flowing before an incident starts, not set up during one.

Notify Executives Using the Documented Tree

The executive notification tree from the prerequisites checklist gets used now, not improvised. The CEO, the board if applicable, and any department heads whose teams are affected get a short, factual update: what is confirmed, what is still unknown, what happens next. A second update follows once scope assessment below is further along, so leadership never has to ask for a status check.

Begin Scope Assessment

Scope assessment answers three questions: which systems are affected, which user accounts show suspicious activity, and what data those systems touch. The IT person typically runs this assessment while the incident commander manages the notification tree in parallel, since scope and communication shouldn’t wait on each other. This assessment feeds directly into the minute 30-45 decision on whether OT or production systems are involved.

Minute 30-45: Is Your OT or Production Environment Affected?

Determine Whether OT/Production Systems Are Affected

This is the hardest branch point in the first hour. Manufacturing ransomware incidents disrupt operations in roughly three out of four cases, and about one in four cause a full shutdown of the OT environment, per compiled industry data citing Dragos industrial case-study evidence. The determination usually comes down to whether the affected IT systems share a network path with production controllers, historians, or the equipment that runs the shop floor, which is why the scope assessment from minute 15-30 matters so much here.

TechProComp’s 12-layer security framework, including LAN Zero Trust and endpoint detection and response, is built to support the OT/IT network separation this assessment depends on. For a deeper look at that separation, see separating OT and IT networks.

Production Continuity vs. Forensic Preservation

If OT or production systems are affected, the incident commander faces a direct tradeoff. Keeping production running risks contaminating forensic evidence, while full forensic preservation can mean extended downtime on the shop floor.

There is no universally correct answer. The incident response provider and the insurance carrier, already on the bridge since minute 15, should weigh in before the decision gets made, since each brings a different piece of the calculation, forensic risk from one side and coverage implications from the other.

Document the Decision and Who Made It

Whatever gets decided, write down who made the call, when, and why. A single line in the incident log is enough in the moment, a fuller account can come later, but the who, when, and why should never be reconstructed from memory afterward. That record matters later for the insurance claim, for legal review, and for the after-action report that follows every real incident.

Minute 45-60: What Do You Tell Employees, Customers, and Regulators?

The Executive Disclosure Decision

Legal counsel should be on the response bridge by minute 45, if not earlier. For manufacturers that meet federal critical-infrastructure reporting thresholds, the pending CIRCIA rule is set to require a 72-hour deadline to report a covered cyber incident, and a 24-hour deadline to report a ransom payment if one is made. CISA has repeatedly delayed finalizing the rule, most recently targeting fall 2026, but the two clocks themselves come from the underlying statute and aren’t expected to change once the rule takes effect.

Not every manufacturer meets those specific thresholds, but the deadlines are a useful discipline even for companies that fall outside them: decide fast, document the reasoning, and don’t let disclosure slide by default. A missed deadline is harder to explain to a regulator than a decision that was made and documented, even an imperfect one.

The Production Continuity Decision

The continuity decision from minute 30-45 gets confirmed here, not revisited. Flip-flopping on whether production stays down erodes confidence with both the plant floor and executive leadership.

The Communication Plan

One person approves outbound communication, whether to employees, customers, or regulators. Legal counsel reviews the language before it goes out, and the incident commander confirms who sends it and when. Employees typically hear first through an internal channel, customers and regulators through whatever route the communications plan already specifies, so nobody outside the company learns about the incident before the people inside it do.

5 Things Never to Do During a Ransomware Attack

These five mistakes are the most common reflexive errors in a ransomware response. Each one makes recovery slower, more expensive, or legally riskier.

TechProComp has never dropped the ball; their customer service is outstanding. TechProComp IT Solutions’ efficiency and speed have been instrumental in helping the client grow their team and keep their systems operating. – Angelina Vasquez on Clutch

1. Don’t Power Down Infected Hosts

Powering down loses the memory-resident evidence that isolation preserves. Isolate the segment instead of cutting power, and reserve power-down for the rare device that truly can’t be disconnected any other way.

2. Don’t Restore From a Possibly Compromised Backup

A backup restored before it is verified clean can reinfect the environment it was meant to save. Commvault’s incident response guidance recommends confirming backups are “accessible, clean, and verified” before any restore begins. Skipping that check trades one incident for a second one built on top of it.

3. Don’t Pay Ransom Unilaterally

The U.S. Treasury’s Office of Foreign Assets Control treats facilitating a ransom payment to a sanctioned actor as a potential violation, and strongly discourages all ransom payments regardless. A unilateral payment decision, made without legal counsel and the insurance carrier, can create sanctions exposure that outlasts the original incident.

4. Don’t Communicate Publicly Without Legal

A well-meaning update posted before legal counsel reviews it can create liability that didn’t exist a minute earlier. Route every external statement through the communication plan built at minute 45-60.

5. Don’t Reuse Compromised Credentials

Rotate credentials after containment is confirmed, not before. Resetting passwords too early can tip off an attacker still inside the network that they have been detected, giving them a reason to accelerate rather than retreat.

Printable Wallet Card: The 60-Minute Playbook at a Glance

Front Side: 4 Phases With Timing

The front panel condenses the minute-by-minute timeline into four blocks: 0-5 (confirm and declare), 5-15 (isolate and call), 15-30 (preserve and notify), 30-60 (assess, decide, communicate). Each block gets a single action verb and its time window, sized for a glance under stress.

Back Side: 6 Prerequisites and 5 Never-Dos

The back panel lists the six prerequisites and the five things never to do, condensed to short phrases. Anyone on the response bridge can flip the card and check both lists in seconds.

Download and Print Instructions

Print the card at actual size, laminate it if possible, and put a copy in the incident response kit, the server room, and the Operations Leader’s badge holder. TechProComp gives clients 365-day access to their own IT documentation, the same on-demand-access principle behind carrying a printed wallet card into an incident instead of hunting for a PDF on a locked-down laptop.

Tabletop Drill Template: 4 Ransomware Scenarios to Rehearse

A drill validates the plan before a real incident tests it. CISA’s Tabletop Exercise Packages list ransomware and ICS scenarios among their recognized exercise types, each built around objectives, discussion questions, and an after-action report.

1. Office Encryption Scenario

Employees report locked files across a shared network folder. Run the full minute 0-5 through minute 15-30 sequence: confirm the report is real, declare the incident, isolate the affected segment, and call the incident response provider and insurance carrier in parallel. Then discuss what worked and what stalled.

The after-action questions to ask: did the incident commander declare fast enough, and did the parallel calls actually happen at the same time or did one wait on the other.

2. OT Impact Scenario

An EDR alert coincides with a production line behaving unexpectedly. Practice the minute 30-45 branch point: who decides continuity versus preservation, and how fast. Walk through the specific tradeoff out loud, keeping the line running risks contaminating forensic evidence, while full preservation can mean extended downtime, and confirm everyone on the bridge agrees on who has the authority to make that call before a real incident forces it.

3. Supply-Chain Compromise Scenario

A vendor’s compromised remote-access credentials are the entry point. Focus the discussion on detection speed and on how the notification tree handles a third-party-caused incident. Because the entry point sits outside the company’s own network, this scenario should also test whether the team knows which vendor to call and how fast that vendor can confirm or rule out its own compromise.

4. Insider Data Theft Scenario

An employee’s credentials are used to exfiltrate data before encryption starts. Practice the disclosure decision from minute 45-60 under a scenario where the cause is internal, not external. This scenario tends to surface the hardest version of the communication plan, since HR and legal counsel both need a seat on the bridge before anything about the incident goes further than the response team.

The team’s timely delivery and quick responses have resulted in a fruitful collaboration. Communication is efficient through email. – Verified User on Clutch

Frequently Asked Questions

What do you do in the first hour of a ransomware attack?

Declare the incident once detection is confirmed, isolate the affected segments without powering anything down, notify the incident response provider, insurance carrier, and legal counsel in parallel, and preserve volatile evidence like memory and logs before it is lost. Those four actions, done in roughly that order, define the first 60 minutes for a Texas manufacturer, whether or not OT or production systems turn out to be affected.

Should I shut down infected computers during ransomware?

No, isolate the affected network segment instead of powering it down. Disconnect the network cable, disable WiFi, or block the segment at the switch, whichever is fastest for that device. Powering down destroys memory-resident evidence and, per CISA’s #StopRansomware Guide, should only happen as a last resort when a device can’t be disconnected from the network any other way.

Who do I call first during a ransomware attack?

Call the incident response provider and the insurance carrier at the same time, on parallel calls, not one after the other. Legal counsel should join the response bridge shortly after, well before any decision about disclosure or ransom payment gets made. That parallel-call habit, not a sequential one, is what keeps the response bridge from losing its first 15 minutes to phone tag.

Should you pay a ransomware ransom?

Not unilaterally. Federal OFAC guidance treats facilitating a payment to a sanctioned threat actor as a potential violation, and discourages ransom payments overall.

Any payment decision needs legal counsel and the insurance carrier involved, since prompt, complete self-disclosure to law enforcement is treated as a mitigating factor if a violation is later found.

How long does ransomware recovery take in manufacturing?

Manufacturing’s average ransomware recovery time is 32 days, according to recovery-time data compiled by Total Assure for 2025/2026, placing it between professional services and healthcare on the recovery-speed spectrum. The same data shows 44% of manufacturers paying the ransom and an average recovery cost of $1.9 million for the sector, underscoring why the prerequisites in this playbook matter before an incident starts.

Key Terminology

Incident Commander (IC): The single person with the authority to declare an incident and make containment decisions during a response. At most Texas manufacturers in this playbook’s target size range, the Operations Leader ends up in this role because the IT person is occupied with technical remediation.

Endpoint Detection and Response (EDR): Software that monitors devices for suspicious behavior and can isolate a compromised endpoint automatically. EDR is one of the four common detection sources for a ransomware attack, alongside employee reports, file-extension changes, and ransom notes.

Incident Response Support (sometimes called an IR retainer): The standing relationship with an external provider, engaged on the parallel call at minute 5-15, rather than a cold outreach made after an attack starts. TechProComp provides this through its 24/7/365 monitoring and Co-Managed IT services.

OFAC Sanctions Exposure: The risk that a ransom payment reaches a sanctioned individual or organization, potentially violating U.S. Treasury regulations regardless of whether the payer knew the recipient was sanctioned. It is why a unilateral ransom payment decision carries legal risk beyond the ransom amount itself.

Forensic Preservation: The practice of protecting volatile evidence, memory contents, security logs, and telemetry, before it disappears through a reboot or log rotation. Forensic preservation is what isolation protects and what a premature shutdown destroys.

Book a ransomware tabletop exercise with TechProComp. We will run a 60-minute drill with your team and produce an after-action report you can bring to your CEO. Get started with TechProComp.

---