<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-ransomware-communication-protocols
description: >-
  Establish and execute communication protocols during ransomware incidents.
  Covers internal stakeholder notification chains, external communication
  with regulators and law enforcement, media and customer communication
  templates, legal privilege preservation, and negotiation communication
  channels.
domain: cybersecurity
subdomain: ransomware-defense
tags:
  - incident-communication
  - notification-protocols
  - regulatory-compliance
  - law-enforcement
  - media-response
  - legal-privilege
  - stakeholder-management
  - breach-notification
version: '1.0'
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Implementing Ransomware Communication Protocols

## Overview

Communication failures during ransomware incidents cause more lasting damage
than the encryption itself. Delayed regulatory notifications trigger fines,
uncoordinated media responses destroy trust, and poor internal communication
leads to duplicate recovery efforts or evidence destruction.

A pre-built communication protocol eliminates decision paralysis during the
critical first 24 hours when every minute matters.

## Prerequisites

| Tool | Purpose | Install |
|------|---------|---------|
| jq | JSON processing for templates | `apt install jq` |
| mutt/msmtp | Emergency email capability | `apt install mutt msmtp` |
| gpg | Encrypted communications | `apt install gnupg` |
| Signal CLI | Secure out-of-band messaging | GitHub release |
| pandoc | Report generation | `apt install pandoc` |

## Key Concepts

### Communication Timeline

```
T+0 min:  Incident declared — IR lead notified
T+15 min: CISO/CTO notified via out-of-band channel
T+30 min: Executive leadership briefed (CEO, General Counsel)
T+1 hr:   Legal counsel engaged (privilege established)
T+2 hr:   Cyber insurance carrier notified (claims hotline)
T+4 hr:   Law enforcement notified (FBI IC3 / local CIRT)
T+24 hr:  Board notification (if material impact)
T+72 hr:  GDPR DPA notification (if EU data affected)
T+varies: Customer/public notification (per legal guidance)
```

### Notification Requirements by Regulation

| Regulation | Deadline | Authority | Trigger |
|-----------|----------|-----------|---------|
| GDPR Art. 33 | 72 hours | Supervisory Authority | Personal data breach |
| HIPAA | 60 days | HHS OCR | PHI breach >500 records |
| SEC 8-K | 4 business days | SEC | Material cybersecurity incident |
| PCI DSS | Immediately | Card brands + acquirer | Cardholder data breach |
| State breach laws | 30-60 days | State AG | PII exposure (varies) |

## Workflow

### Step 1 — Establish Out-of-Band Communication

```bash
# Verify GPG keys for encrypted email (pre-staged)
gpg --list-keys --keyid-format 0xlong | grep -A1 "pub" | head -20

# Test out-of-band email delivery
echo "RANSOMWARE INCIDENT TEST — $(date -u)" | \
  gpg --encrypt --armor --recipient ir-team@company.com | \
  mutt -s "[TEST] Incident Communication Check" ir-team@company.com

# Verify Signal CLI is operational
signal-cli -u +1XXXXXXXXXX send -m "IR communication test" +1YYYYYYYYYY 2>/dev/null
echo "Signal delivery status: $?"
```

### Step 2 — Internal Notification Template

```
============================================================
CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGED
RANSOMWARE INCIDENT NOTIFICATION — INTERNAL
============================================================
Date/Time:    [YYYY-MM-DD HH:MM UTC]
Severity:     [CRITICAL/HIGH]
Incident ID:  [INC-YYYY-NNNN]

SITUATION:
Ransomware activity detected on [N] systems in [LOCATION/SEGMENT].

AFFECTED SYSTEMS:
- [List affected systems, segments, data types]

CURRENT ACTIONS:
1. Network isolation of affected segment: [COMPLETE/IN PROGRESS]
2. Forensic evidence preservation: [COMPLETE/IN PROGRESS]
3. Backup integrity verification: [COMPLETE/IN PROGRESS]

DO NOT:
- Communicate via corporate email (may be compromised)
- Contact affected systems directly
- Discuss details outside this notification chain
============================================================
```

### Step 3 — Regulatory Notification Checklist

```bash
#!/bin/bash
echo "=== REGULATORY NOTIFICATION CHECKER ==="
echo ""
echo "Data types affected: PII, PHI, PCI, financial, EU_resident"
echo ""
echo "REQUIRED NOTIFICATIONS:"
echo "  GDPR Art. 33 — 72-hour notification to DPA"
echo "  HIPAA — 60-day notification to HHS OCR"
echo "  SEC 8-K — 4 business day filing (if material)"
echo "  PCI DSS — Immediate to card brands"
echo "  State breach — 30-60 days to State AG"
echo ""
echo "ALWAYS NOTIFY:"
echo "  - Cyber insurance carrier"
echo "  - Legal counsel"
echo "  - FBI IC3 (https://www.ic3.gov/)"
echo "  - CISA (https://www.cisa.gov/stopransomware)"
```

## Verification

- [ ] Out-of-band communication channel tested monthly
- [ ] Contact list updated quarterly with verified phone/Signal numbers
- [ ] Internal notification template reviewed by legal counsel
- [ ] Regulatory notification deadlines documented per data type
- [ ] Law enforcement reporting procedure documented and tested
- [ ] Media holding statement pre-approved by legal and PR

## References

- GDPR Article 33: Notification of Personal Data Breach
- HIPAA Breach Notification Rule: 45 CFR 164.400-414
- SEC Cybersecurity Disclosure Rules (2023)
- CISA StopRansomware: Reporting Resources
- FBI IC3: Internet Crime Complaint Center
