Ransomware negotiation and payment policy: decide before the incident

Reference article · 6 min read

An agency that has not written down its position on ransom payment will end up improvising one under the worst conditions available: systems down, staff exhausted, an elected official asking for a number, and an attacker running a countdown clock. The payment decision itself is genuinely hard, and it depends on facts nobody has in the first hours. What does not have to be improvised is everything around it: who decides, who is permitted to speak to the attacker, what legal checks must clear before money moves, how money would actually move, and what gets said afterward.

This is a governance document, not a technical one. It belongs alongside the incident response plan, adopted at a level that can commit the organization, and rehearsed with the people whose names appear in it. The point is not to pre-commit to paying or to refusing. The point is that whichever way the decision goes, it was made by the right people, on the record, and within the law.

Separate the decision from the deliberation

Write down four things and keep them to a page or two.

• Who decides. Usually the chief executive (city manager, county administrator, agency head), acting on the advice of counsel, with a defined role for the governing body.
• Who must be consulted before the decision is final. Legal counsel, the CIO or CISO, finance and risk management, the insurer or broker, and the law enforcement liaison.
• What escalates. Identify the point at which the expenditure exceeds the executive's emergency authority and requires the governing body, and how quickly that body can lawfully convene.
• What the default is. Many agencies adopt a stated presumption against payment that can be overcome only under specific conditions, such as no viable restoration path within an acceptable window or a direct life-safety consequence. A default forces the discussion to be about evidence rather than nerves.

No staff member talks to the attacker

Contact with a threat actor is a specialized function, and it should be handled by a retained negotiation firm working under the direction of counsel. Staff statements can be quoted back, misread, or treated as commitments. Experienced negotiators know the behavior patterns of specific actor groups, can request proof that decryption works, and can probe claims about exfiltrated data.

The policy should say plainly that no employee replies to the ransom note, opens the attacker's portal, or acknowledges contact; that all inbound communication is routed to counsel; that the note and related artifacts are preserved; and that every exchange is briefed in writing before and after. It should also state the obvious point that engaging a negotiator is not a decision to pay. Engagement buys time and information, and it can be ended.

Sanctions screening and other legal limits

Paying a ransom can put an agency on the wrong side of United States sanctions law if the recipient is a designated person, entity, or jurisdiction. The Office of Foreign Assets Control has issued advisories describing that risk and the mitigating weight it gives to reporting to and cooperating with law enforcement. Screening should be performed and documented by counsel together with the negotiation firm and any payment facilitator before funds move, not after.

Other constraints to confirm with counsel, because they change:

• State law. Some states restrict or prohibit ransom payments by public entities, and some require notice to a state agency. Check your own state's current statute rather than relying on what was true a year ago.
• Federal reporting. Federal incident and ransom payment reporting obligations for certain critical infrastructure entities are being implemented through rulemaking. Confirm what applies to your organization and when.
• Facilitator obligations. Firms that move funds are subject to federal financial crime rules. Ask about their registration status.
• Grant and contract terms. Funding agreements may carry their own incident notification duties.

Insurance terms set the sequence

Read the policy before there is an incident, with someone who reads policies for a living. Most cyber policies condition coverage on prompt notice and on the insurer's consent before costs are incurred, including any extortion payment. Paying first and asking later is a reliable way to lose reimbursement.

Carriers also maintain panels of approved forensics, counsel, and negotiation firms. Using an off-panel firm without written approval can leave the cost with the agency. If your preferred vendors are not on the panel, raise it at renewal and seek pre-approval in writing. Understand the extortion sublimit, the business interruption waiting period, and the retention, because those numbers shape what the executive is actually deciding. Agencies in self-insured pools should confirm the pool's equivalent rules, which are not always written like a commercial policy.

Procurement mechanics you can test now

• Emergency authority. Know which ordinance or statute permits an emergency purchase, who declares the emergency, what documentation is required, and how soon the governing body must ratify.
• Retainers before the fact. Competitively procured retainers for incident response, negotiation, and breach counsel avoid a sole source justification written at hour six. Cooperative or state term contracts may already be available.
• The payment path. Agencies rarely acquire cryptocurrency directly. The settlement firm typically executes the transaction and invoices. Work out in advance with finance and counsel how that expense is authorized, coded, and audited.
• Controls under duress. Confirm signature authority and out-of-band verification for large wires, since incidents attract opportunistic fraud.
• Offline copies. Keep contracts, policy numbers, and contact lists printed and stored where a ransomware event cannot reach them.

What the governing body and the public will ask afterward

Assume the decision becomes public. Open meeting laws may allow a closed session to discuss security or litigation, but the exemptions are specific and the ratifying vote usually happens in open session. Records related to the incident may be subject to public records law, with narrow exemptions for security information.

Data breach notification duties are separate from the payment question, and an attacker's promise to delete stolen data does not satisfy them. Build the record while it is fresh: a decision memo capturing what was known, what options existed, what advice was received, and the basis for the choice. When you engage vendors, ask how they screen for sanctions and document it, who executes any transaction, whether they sit on your carrier's panel, what response times the retainer guarantees, and whether they engage through counsel to preserve privilege.

HQT works with state and local agencies on cybersecurity planning and technology advisory services, including incident readiness documentation.

Frequently asked questions