After a ransomware note hits a city permitting system, several managers insist the event is 'PR risk only' and should skip technical risk registers. What primary risk type should drive the response?

A ransomware note against a city permitting system is primarily technology and information risk because confidentiality, integrity, and availability of civic applications and records are under active attack and must drive containment, forensics, restoration, and data-protection controls. Residents depend on permitting continuity; treating the event as public-relations theater alone delays the technical registers and playbooks that restore service. Seasonal landscaping risk is an unrelated environmental facilities category and does not govern malware response priorities. Parking-lot slip exposure belongs in physical safety management, not cyber incident command. Brand-color refresh is a communications aesthetics task, not the primary risk type when systems are encrypted or offline. Reputation harm is often a real secondary consequence, yet corporate risk typing starts with the exposure that dictates first-line controls. Exam caveat: secondary brand impacts may be tracked, but they do not reclassify ransomware as a communications-only event under CRMC-style frameworks. Operational check: open the incident under the technology and information risk owner, execute isolation and restore steps from the cyber and continuity playbook, preserve evidence, notify stakeholders with approved facts, and only then sequence reputation messaging as a supporting workstream with a named communications lead.