During a ransomware attack, the board should communicate through a pre-established, secure out-of-band channel that works independently of affected corporate systems. The arrangement should allow directors to receive verified updates, discuss sensitive issues, authorise decisions and retain a record of their actions—even when email, Microsoft Teams or corporate sign-in services are unavailable.
For enterprise security and business continuity teams, that creates a practical responsibility: make sure the organisation’s leadership can still function when the tools it normally relies on cannot be used.
A board may need to consider service disruption, emergency expenditure, customer harm and recovery priorities while the investigation is still developing. Directors need a dependable way to assemble, understand the situation and exercise judgement under pressure.
Board communication can fail because several apparently separate tools depend on the same underlying systems. Meeting invitations arrive through Outlook, papers sit in SharePoint and discussions take place in Teams. Access may rely on the same corporate identity provider.
An attack—or a containment decision to disconnect systems—can interrupt that entire process. Directors may lose access to the meeting, the briefing pack and the instructions explaining what to do next.
There is also a question of trust. An accessible mailbox is not necessarily safe if an attacker controls the account. A familiar sender name does not establish that a request is genuine.
The NCSC’s guidance on immediate response to disruptive cyber attacks advises organisations to establish whether corporate communication channels are available and trustworthy, and to use alternatives where necessary.
Your board communication plan should address both conditions: what happens when normal tools stop working, and what happens when they can no longer be trusted?
Out-of-band communication gives directors a separate route for coordinating outside the systems affected by an incident. Its value depends on whether the whole access process can operate independently.
A second application may still depend on corporate single sign-on, a company VPN or an email account used to reset passwords. Those dependencies can undermine the fallback precisely when it is needed.
Before adopting an alternative, test whether directors can:
Out-of-band communications still require suitable devices and connectivity. Include an alternative contact route for a director who has lost their phone, cannot access the internet or is travelling when the incident begins.
A useful plan answers six questions before an attack occurs.
Name the role authorised to activate it and a deputy. Set triggers such as suspected compromise of corporate accounts, loss of collaboration services or a decision to isolate the network.
Make switching channels an established incident response action. Directors should already know where to go and how they will be notified.
Maintain an approved participant list covering directors, relevant executives and the people supporting governance and incident reporting. Define how legal advisers or other external specialists can be included when required.
Keep membership current as roles change. Confirm how non-executive directors will access the service, particularly where they use different devices or work across several organisations.
Assign an executive to consolidate information from the incident response team. Technical findings, operational impacts and recovery estimates should reach directors through an agreed reporting process.
Give the board a clear route for questions, with someone responsible for obtaining answers. This helps prevent conflicting updates and repeated requests interrupting the investigation.
Document escalation thresholds and delegated authority. The response team should know which actions it can take immediately, which require executive approval and which need board consideration.
Include arrangements for urgent decisions when a key individual is unavailable, consistent with your organisation’s governance requirements.
Keep the board incident pack accessible outside the normal document environment. Include communication instructions, contacts, responsibilities and the relevant business continuity plans.
Where documents are available offline, assign someone to keep copies current and control access. A downloaded plan is useful only if directors can find it and know it is the right version.
Assign a person to maintain the decision log and track actions. Agree where the authoritative record lives, who can access it and how it will be preserved after the incident.
Activate the agreed notification process, direct participants to the established communication channel and confirm who has joined. Keep sensitive incident details within the controlled environment rather than placing them in a broad initial alert.
A practical activation sequence is:
1. Notify: tell directors that the incident communication arrangements are active and give the agreed joining instructions.
2. Verify: check participants against the approved list and follow up through known contact details with anyone who has not responded.
3. Brief: provide a timestamped summary of confirmed facts, business impact and immediate decisions required.
4. Coordinate: confirm who leads the briefing, who records decisions and when the next update will arrive.
An alert being sent does not establish that everyone has received or understood it. Build acknowledgement and escalation into the process.
For urgent or unusual requests, use an established verification route. A request claiming to come from the chair or chief executive should not, by itself, be sufficient authority to transfer money or change recovery priorities.
Effective ransomware attack communication connects the incident to its business consequences. Directors need a concise view of what is happening, what remains uncertain and where their judgement is required.
Use the same structure for each update:
“Customer systems remain offline” describes the situation. “Customer systems remain offline; the proposed manual workaround needs additional staffing approval” explains why the board or executive team needs to act.
Separate confirmed facts from working assumptions. If data theft has not been established, describe it as under investigation. Give recovery estimates with their dependencies and uncertainties rather than presenting an early technical assessment as a commitment.
Agree an update frequency that reflects the incident’s pace. Provide immediate escalation for material changes, such as a significant increase in service impact or a decision that cannot wait until the next meeting.
Restrict sensitive discussions to authorised participants and review access as people join or leave the response. Keep board deliberations separate from detailed operational investigation traffic, with a named person responsible for passing relevant updates and decisions between them.
Agree with legal advisers how their advice should be shared and retained. A secure communication platform supports confidentiality; the platform alone does not establish legal privilege.
Coordinate external messaging through an agreed approval process. Staff, customer and public communications should reflect the same verified understanding of the incident, while providing the detail each audience needs.
The NCSC’s cyber incident communication guidance emphasises preparation, clear responsibilities and accurate, timely messaging. That discipline also matters inside the boardroom: unsupported reassurance can distort decisions as well as external statements.
Record what was decided, who authorised it and the information available at the time. Include the main reasons for the decision, significant uncertainty, the action owner and any deadline or review point.
For example, an approval to prioritise one service over another should explain the business considerations behind that choice. A later reviewer needs to understand the situation the board faced, including the limits of what was known.
Messages and meeting records provide supporting evidence, but important approvals should be explicitly recorded. Confirm that agreed actions have reached the people responsible for carrying them out.
The UK’s guidance for organisations during ransomware incidents recommends keeping decision records offline or on systems unaffected by the incident.
Sentinel supports boards and executive teams with an independent out-of-band environment for crisis communication when everyday systems are disrupted or cannot be trusted.
Secure collaboration and controlled access bring authorised participants together, while critical document access helps keep plans and contacts available. Auditable records support the review of communications and decisions. Sentinel’s single-tenant architecture gives each client a separate instance.
For your security and business continuity teams, the practical step is to build those capabilities into the board’s incident arrangements: establish the communication space, enrol participants, prepare documents and rehearse access without corporate SSO.
The objective is a board that already knows how to connect and work together when the incident starts.
Run an exercise in which corporate email, Teams, shared documents and normal sign-in are unavailable. Ask directors to use the actual alternative channel and retrieve the documents they would need during an attack.
Measure how long it takes to reach participants, establish a verified meeting and make a time-sensitive decision. Include an absent director, an access problem and a suspicious request claiming to come from a senior executive.
Afterwards, review whether the decision record explains what was known, what was agreed and who acted. Use the findings to improve contact details, access arrangements and responsibilities.
The UK Cyber Governance Code of Practice calls for boards to gain assurance that incident plans are exercised at least annually and that lessons inform future preparation.
We recommend moving board discussions to a pre-established, independent out-of-band communication channel during a ransomware attack, even if Teams remains available.
Corporate accounts, identity services or devices may be compromised before the full extent of the attack is understood. Using a separate, trusted environment reduces reliance on potentially affected systems while the incident team investigates.
A messaging group may help people make contact, but assess its access dependencies, participant verification, administration and record retention. Board communication also needs workable arrangements for documents, meetings, approvals and action tracking.
Assign ownership in the incident plan. A designated executive should coordinate verified updates, with a governance lead recording decisions and the incident commander managing operational reporting. Adapt those roles to your organisation’s structure.
Use an agreed transition after the incident team confirms that the relevant systems and access arrangements are suitable for use. Tell everyone which channel is authoritative and preserve the incident records.
Your board communication arrangements should be ready before directors need them: an independent channel, established access, clear responsibilities and a reliable decision record.
If corporate email and Teams became unavailable today, could your directors assemble, review the situation and authorise an urgent decision?
Book a Sentinel board briefing to explore how independent out-of-band communications can keep your leadership team connected during a ransomware attack.