A company's written IR policy requires notifying the legal team before taking containment actions on any system. During an active ransomware outbreak, the IR team is containment-ready but the legal team is unreachable for 2 hours. What should the IR team do?
Select an answer to reveal the explanation.
Short Explanation
When legal's unreachable, use the IR plan's escalation path for emergency authorization, take documented containment actions to stop the spread, and brief legal as soon as they're reached. You can't let ransomware run for two hours just because the normal chain is broken.
Full Explanation
The correct choice is following the escalation path defined in the IR plan, such as notifying the CISO or designated alternate for emergency authorization, taking documented containment actions to prevent further spread, and briefing legal as soon as they are reached. IR plans should include escalation paths for scenarios where the standard notification chain is unavailable; the CISO or alternate authority can provide emergency authorization, and documented actions with a paper trail satisfy legal requirements. Active ransomware spreading across the network constitutes an emergency that justifies emergency authorization procedures. Waiting the full 2 hours for legal approval, as the policy is absolute, is wrong because 2 hours of unrestricted ransomware spread can cause catastrophic business impact; good IR planning anticipates this. Taking no action and documenting that legal was unreachable is wrong because inaction during active spread is negligent and causes avoidable harm. Calling the attackers' ransom negotiation line to buy time is wrong because engaging the ransom channel during spread does not stop encryption and may expose negotiation strategy.