How to Brief the Board During a Ransomware Attack

When ransomware disrupts your organisation, the Board needs clear information, timely updates and the ability to make critical decisions. But what happens when the systems you rely on to communicate with directors are compromised too?

For the CIO or CTO, this creates a dual responsibility: coordinating the technical response while ensuring the Board can continue to exercise effective oversight.

In a large organisation, particularly one operating in a regulated industry, that responsibility extends beyond keeping directors informed. It means supporting decisions that protect customers, employees, essential services and the organisation's long-term resilience.

Here is a practical playbook for maintaining effective board communication during a ransomware attack.

1. Establish a secure communication channel

Your first priority is ensuring that you can reach the Board without relying on systems that may be compromised.

Ransomware can disrupt email, Microsoft Teams, corporate telephony and identity services. Even if these systems remain operational, you may not be able to trust them.

Establish independent, out-of-band communication channels that remain accessible when your primary network is unavailable.

With YUDU Sentinel, authorised directors and incident leaders can use secure messaging, crisis rooms and emergency notifications independently of the affected corporate infrastructure.

Before an incident: Confirm that every director knows how to access the platform, has the necessary credentials and understands when to use it.

2. Deliver an initial briefing based on verified facts

Once secure channels are established within the platform, provide an initial briefing as soon as you have enough verified information to communicate meaningfully.

The Board does not need a detailed technical investigation report at this stage. It needs a concise understanding of the situation and its implications.

Your initial briefing should cover:

• What happened: What is known about the ransomware incident, when it was detected and whether the attack is ongoing.
• What is affected: Which systems, business functions and services are disrupted.
• Business impact: The immediate implications for operations, customers, employees and critical services.
• Response underway: What the incident response team is doing to contain the attack and assess its scope.
• Current uncertainties: What remains unknown and when further information is expected.

Be clear about the distinction between confirmed facts, preliminary assessments and unanswered questions. Avoid speculation or assurances that may need to be withdrawn as the investigation progresses.

3. Establish a regular briefing rhythm

During a fast-moving incident, silence can create uncertainty and encourage fragmented communication.

Agree an update schedule with the Chair and Board. The frequency will depend on the severity of the incident, but a predictable cadence helps directors understand when they can expect new information.

Each update should follow a consistent structure:

Sentinel's secure video crisis rooms provide a shared space for these briefings, allowing directors and response leaders to exchange information and maintain a common understanding of the incident.

4. Give the Board decision-ready information

The CIO or CTO should help the Board focus on the decisions that require its attention, rather than overwhelming directors with technical detail.

Depending on the incident, these decisions might include:

• Authorising emergency expenditure or external incident response support.
• Approving significant operational changes or service suspensions.
• Assessing whether customer, employee or regulatory notifications are required.
• Agreeing business continuity priorities and recovery objectives.
• Reviewing the organisation's position on a ransom demand, with appropriate legal and specialist advice.

For each decision, explain the options, likely consequences, relevant risks and the recommended course of action.

Sentinel's secure messaging and video crisis rooms allow directors to discuss sensitive matters with authorised colleagues, even when normal collaboration tools are unavailable.

5. Maintain an auditable record of decisions

During a ransomware attack, important decisions may be made under significant time pressure. The organisation must be able to demonstrate what was known, what was considered and why a particular course of action was chosen.

This is especially important for organisations subject to regulatory scrutiny, including financial services, healthcare and critical infrastructure.

Maintain a record of:

• Briefings and material updates shared with directors.
• Decisions, approvals and the individuals responsible.
• The rationale and information supporting significant decisions.
• Actions assigned, owners and deadlines.
• Changes in the incident's scope, impact and risk assessment.

YUDU Sentinel provides a tamper-evident audit trail of communications and activity, helping organisations preserve evidence of their response and governance.

This does not replace formal board minutes or regulatory reporting. It supports those processes by keeping an accessible record of the incident as it unfolds.

6. Keep the Board informed through recovery

Board communication should not stop when the immediate threat is contained.

Directors need continued visibility of recovery progress, outstanding risks and the organisation's return to normal operations.

Provide updates on:

• Restoration of critical systems and services.
• The status of data integrity and any confirmed data compromise.
• Outstanding operational and security risks.
• Regulatory, legal and customer communication obligations.
• Lessons learned and improvements to resilience.

Sentinel can continue to support secure communication and access to critical response documentation throughout recovery, including when corporate systems remain unavailable.

Prepare before the incident

The effectiveness of board communication during a ransomware attack depends on decisions made long before the attack begins.

Organisations should identify who is responsible for briefing the Board, agree escalation thresholds, prepare briefing templates, establish independent communication channels and exercise the process regularly.

For CIOs and CTOs, this is an opportunity to demonstrate that cyber resilience extends beyond technical recovery. It includes the organisation's ability to lead, make decisions and maintain accountability when its normal systems can no longer be trusted.

Keeping the Board connected when it matters most

YUDU Sentinel provides an independent communication and collaboration environment for directors and incident response teams during cyber incidents and major IT outages.

From secure crisis rooms and emergency notifications to offline-accessible critical documents and an auditable record of decisions, Sentinel helps leadership teams maintain control when their primary systems are compromised.

Explore our Board of Directors use case to see how Sentinel supports board-level communication and oversight during a crisis.