Board Communications During Ransomware: A Practical Guide

During a ransomware attack, the board should communicate through a pre-established, secure out-of-band channel that works independently of affected corporate systems. The arrangement should allow directors to receive verified updates, discuss sensitive issues, authorise decisions and retain a record of their actions—even when email, Microsoft Teams or corporate sign-in services are unavailable.

For enterprise security and business continuity teams, that creates a practical responsibility: make sure the organisation’s leadership can still function when the tools it normally relies on cannot be used.

A board may need to consider service disruption, emergency expenditure, customer harm and recovery priorities while the investigation is still developing. Directors need a dependable way to assemble, understand the situation and exercise judgement under pressure.

Why do board communications fail during ransomware attacks?

Board communication can fail because several apparently separate tools depend on the same underlying systems. Meeting invitations arrive through Outlook, papers sit in SharePoint and discussions take place in Teams. Access may rely on the same corporate identity provider.

An attack—or a containment decision to disconnect systems—can interrupt that entire process. Directors may lose access to the meeting, the briefing pack and the instructions explaining what to do next.

There is also a question of trust. An accessible mailbox is not necessarily safe if an attacker controls the account. A familiar sender name does not establish that a request is genuine.

The NCSC’s guidance on immediate response to disruptive cyber attacks advises organisations to establish whether corporate communication channels are available and trustworthy, and to use alternatives where necessary.

Your board communication plan should address both conditions: what happens when normal tools stop working, and what happens when they can no longer be trusted?

What does out-of-band communication mean for a board?

Out-of-band communication gives directors a separate route for coordinating outside the systems affected by an incident. Its value depends on whether the whole access process can operate independently.

A second application may still depend on corporate single sign-on, a company VPN or an email account used to reset passwords. Those dependencies can undermine the fallback precisely when it is needed.

Before adopting an alternative, test whether directors can:

• Sign in when corporate identity services, including Microsoft Entra ID, are unavailable.
• Join from an approved device outside the affected network.
• Find joining instructions without opening corporate email.
• Access essential documents when the normal repository is unavailable.
• Recover access through an agreed process that does not depend on compromised systems.

Out-of-band communications still require suitable devices and connectivity. Include an alternative contact route for a director who has lost their phone, cannot access the internet or is travelling when the incident begins.

What should a board communication plan contain?

A useful plan answers six questions before an attack occurs.

1. Who activates the alternative channel(s)?

Name the role authorised to activate it and a deputy. Set triggers such as suspected compromise of corporate accounts, loss of collaboration services or a decision to isolate the network.

Make switching channels an established incident response action. Directors should already know where to go and how they will be notified.

2. Who needs to join?

Maintain an approved participant list covering directors, relevant executives and the people supporting governance and incident reporting. Define how legal advisers or other external specialists can be included when required.

Keep membership current as roles change. Confirm how non-executive directors will access the service, particularly where they use different devices or work across several organisations.

3. Who provides the board’s updates?

Assign an executive to consolidate information from the incident response team. Technical findings, operational impacts and recovery estimates should reach directors through an agreed reporting process.

Give the board a clear route for questions, with someone responsible for obtaining answers. This helps prevent conflicting updates and repeated requests interrupting the investigation.

4. Which decisions need board involvement?

Document escalation thresholds and delegated authority. The response team should know which actions it can take immediately, which require executive approval and which need board consideration.

Include arrangements for urgent decisions when a key individual is unavailable, consistent with your organisation’s governance requirements.

5. Where are the essential documents?

Keep the board incident pack accessible outside the normal document environment. Include communication instructions, contacts, responsibilities and the relevant business continuity plans.

Where documents are available offline, assign someone to keep copies current and control access. A downloaded plan is useful only if directors can find it and know it is the right version.

6. Who records decisions and follows up?

Assign a person to maintain the decision log and track actions. Agree where the authoritative record lives, who can access it and how it will be preserved after the incident.

How should you contact the board when an attack begins?

Activate the agreed notification process, direct participants to the established communication channel and confirm who has joined. Keep sensitive incident details within the controlled environment rather than placing them in a broad initial alert.

A practical activation sequence is:

1. Notify: tell directors that the incident communication arrangements are active and give the agreed joining instructions.

2. Verify: check participants against the approved list and follow up through known contact details with anyone who has not responded.

3. Brief: provide a timestamped summary of confirmed facts, business impact and immediate decisions required.

4. Coordinate: confirm who leads the briefing, who records decisions and when the next update will arrive.

An alert being sent does not establish that everyone has received or understood it. Build acknowledgement and escalation into the process.

For urgent or unusual requests, use an established verification route. A request claiming to come from the chair or chief executive should not, by itself, be sufficient authority to transfer money or change recovery priorities.

What information does the board need during a ransomware attack?

Effective ransomware attack communication connects the incident to its business consequences. Directors need a concise view of what is happening, what remains uncertain and where their judgement is required.

Use the same structure for each update:

• Current position: confirmed facts, the time of the update and the source of the information.
• Business impact: affected services, people, customers and critical dependencies.
• Uncertainty: unanswered questions and the work underway to resolve them.
• Response: containment, continuity and recovery actions in progress.
• Decision required: options, recommendation, trade-offs and the deadline for a decision.
• Next update: its timing, owner and the circumstances that would trigger an earlier escalation.

“Customer systems remain offline” describes the situation. “Customer systems remain offline; the proposed manual workaround needs additional staffing approval” explains why the board or executive team needs to act.

Separate confirmed facts from working assumptions. If data theft has not been established, describe it as under investigation. Give recovery estimates with their dependencies and uncertainties rather than presenting an early technical assessment as a commitment.

Agree an update frequency that reflects the incident’s pace. Provide immediate escalation for material changes, such as a significant increase in service impact or a decision that cannot wait until the next meeting.

How do you keep board discussions secure and coordinated?

Restrict sensitive discussions to authorised participants and review access as people join or leave the response. Keep board deliberations separate from detailed operational investigation traffic, with a named person responsible for passing relevant updates and decisions between them.

Agree with legal advisers how their advice should be shared and retained. A secure communication platform supports confidentiality; the platform alone does not establish legal privilege.

Coordinate external messaging through an agreed approval process. Staff, customer and public communications should reflect the same verified understanding of the incident, while providing the detail each audience needs.

The NCSC’s cyber incident communication guidance emphasises preparation, clear responsibilities and accurate, timely messaging. That discipline also matters inside the boardroom: unsupported reassurance can distort decisions as well as external statements.

What should the board’s decision record include?

Record what was decided, who authorised it and the information available at the time. Include the main reasons for the decision, significant uncertainty, the action owner and any deadline or review point.

For example, an approval to prioritise one service over another should explain the business considerations behind that choice. A later reviewer needs to understand the situation the board faced, including the limits of what was known.

Messages and meeting records provide supporting evidence, but important approvals should be explicitly recorded. Confirm that agreed actions have reached the people responsible for carrying them out.

The UK’s guidance for organisations during ransomware incidents recommends keeping decision records offline or on systems unaffected by the incident.

How does Sentinel support board communications during ransomware?

Sentinel supports boards and executive teams with an independent out-of-band environment for crisis communication when everyday systems are disrupted or cannot be trusted.

Secure collaboration and controlled access bring authorised participants together, while critical document access helps keep plans and contacts available. Auditable records support the review of communications and decisions. Sentinel’s single-tenant architecture gives each client a separate instance.

For your security and business continuity teams, the practical step is to build those capabilities into the board’s incident arrangements: establish the communication space, enrol participants, prepare documents and rehearse access without corporate SSO.

The objective is a board that already knows how to connect and work together when the incident starts.

How should you test board communication arrangements?

Run an exercise in which corporate email, Teams, shared documents and normal sign-in are unavailable. Ask directors to use the actual alternative channel and retrieve the documents they would need during an attack.

Measure how long it takes to reach participants, establish a verified meeting and make a time-sensitive decision. Include an absent director, an access problem and a suspicious request claiming to come from a senior executive.

Afterwards, review whether the decision record explains what was known, what was agreed and who acted. Use the findings to improve contact details, access arrangements and responsibilities.

The UK Cyber Governance Code of Practice calls for boards to gain assurance that incident plans are exercised at least annually and that lessons inform future preparation.

Frequently asked questions

Can directors continue using Teams during a ransomware attack?

We recommend moving board discussions to a pre-established, independent out-of-band communication channel during a ransomware attack, even if Teams remains available.

Corporate accounts, identity services or devices may be compromised before the full extent of the attack is understood. Using a separate, trusted environment reduces reliance on potentially affected systems while the incident team investigates.

Is a backup messaging group enough?

A messaging group may help people make contact, but assess its access dependencies, participant verification, administration and record retention. Board communication also needs workable arrangements for documents, meetings, approvals and action tracking.

Who should own board communications during an incident?

Assign ownership in the incident plan. A designated executive should coordinate verified updates, with a governance lead recording decisions and the incident commander managing operational reporting. Adapt those roles to your organisation’s structure.

When should directors return to normal communication tools?

Use an agreed transition after the incident team confirms that the relevant systems and access arrangements are suitable for use. Tell everyone which channel is authoritative and preserve the incident records.

Could your board still lead if normal systems failed today?

Your board communication arrangements should be ready before directors need them: an independent channel, established access, clear responsibilities and a reliable decision record.

If corporate email and Teams became unavailable today, could your directors assemble, review the situation and authorise an urgent decision?

Book a Sentinel board briefing to explore how independent out-of-band communications can keep your leadership team connected during a ransomware attack.