When ransomware disrupts your organisation, the Board needs clear information, timely updates and the ability to make critical decisions. But what happens when the systems you rely on to communicate with directors are compromised too?
For the CIO or CTO, this creates a dual responsibility: coordinating the technical response while ensuring the Board can continue to exercise effective oversight.
In a large organisation, particularly one operating in a regulated industry, that responsibility extends beyond keeping directors informed. It means supporting decisions that protect customers, employees, essential services and the organisation's long-term resilience.
Here is a practical playbook for maintaining effective board communication during a ransomware attack.
Your first priority is ensuring that you can reach the Board without relying on systems that may be compromised.
Ransomware can disrupt email, Microsoft Teams, corporate telephony and identity services. Even if these systems remain operational, you may not be able to trust them.
Establish independent, out-of-band communication channels that remain accessible when your primary network is unavailable.
With YUDU Sentinel, authorised directors and incident leaders can use secure messaging, crisis rooms and emergency notifications independently of the affected corporate infrastructure.
Before an incident: Confirm that every director knows how to access the platform, has the necessary credentials and understands when to use it.
Once secure channels are established within the platform, provide an initial briefing as soon as you have enough verified information to communicate meaningfully.
The Board does not need a detailed technical investigation report at this stage. It needs a concise understanding of the situation and its implications.
Your initial briefing should cover:
Be clear about the distinction between confirmed facts, preliminary assessments and unanswered questions. Avoid speculation or assurances that may need to be withdrawn as the investigation progresses.
During a fast-moving incident, silence can create uncertainty and encourage fragmented communication.
Agree an update schedule with the Chair and Board. The frequency will depend on the severity of the incident, but a predictable cadence helps directors understand when they can expect new information.
Each update should follow a consistent structure:
| Briefing section | What to communicate |
|---|---|
| Situation | What has changed since the last update |
| Impact | Current operational, customer and financial implications |
| Response | Containment, investigation and recovery progress |
| Risks | Emerging threats, dependencies and uncertainties |
| Decisions | What the Board needs to decide or authorise |
| Next update | When directors will receive further information |
Sentinel's secure video crisis rooms provide a shared space for these briefings, allowing directors and response leaders to exchange information and maintain a common understanding of the incident.
The CIO or CTO should help the Board focus on the decisions that require its attention, rather than overwhelming directors with technical detail.
Depending on the incident, these decisions might include:
For each decision, explain the options, likely consequences, relevant risks and the recommended course of action.
Sentinel's secure messaging and video crisis rooms allow directors to discuss sensitive matters with authorised colleagues, even when normal collaboration tools are unavailable.
During a ransomware attack, important decisions may be made under significant time pressure. The organisation must be able to demonstrate what was known, what was considered and why a particular course of action was chosen.
This is especially important for organisations subject to regulatory scrutiny, including financial services, healthcare and critical infrastructure.
Maintain a record of:
YUDU Sentinel provides a tamper-evident audit trail of communications and activity, helping organisations preserve evidence of their response and governance.
This does not replace formal board minutes or regulatory reporting. It supports those processes by keeping an accessible record of the incident as it unfolds.
Board communication should not stop when the immediate threat is contained.
Directors need continued visibility of recovery progress, outstanding risks and the organisation's return to normal operations.
Provide updates on:
Sentinel can continue to support secure communication and access to critical response documentation throughout recovery, including when corporate systems remain unavailable.
The effectiveness of board communication during a ransomware attack depends on decisions made long before the attack begins.
Organisations should identify who is responsible for briefing the Board, agree escalation thresholds, prepare briefing templates, establish independent communication channels and exercise the process regularly.
For CIOs and CTOs, this is an opportunity to demonstrate that cyber resilience extends beyond technical recovery. It includes the organisation's ability to lead, make decisions and maintain accountability when its normal systems can no longer be trusted.
YUDU Sentinel provides an independent communication and collaboration environment for directors and incident response teams during cyber incidents and major IT outages.
From secure crisis rooms and emergency notifications to offline-accessible critical documents and an auditable record of decisions, Sentinel helps leadership teams maintain control when their primary systems are compromised.
Explore our Board of Directors use case to see how Sentinel supports board-level communication and oversight during a crisis.