Ransomware Response for Denver Businesses: First-Hour Roles and Decisions

If you are an employee

1. Stop interacting with the suspicious message, file, device, or account.

2. Use the approved incident contact method and report what you observed, when, and where.

3. Do not delete messages, wipe devices, change credentials, notify people broadly, or attempt recovery unless you are authorized.

First-hour role matrix

Decision points, not a universal technical recipe

Isolation, credential changes, shutdowns, restoration, evidence collection, payment discussions, external notifications, and public communications require authorized coordination appropriate to the incident. The approved plan, policy terms, technical facts, and responder authority determine the next action.

Evidence-preservation cautions

Do not wipe systems, delete messages or logs, broadly notify people, negotiate, pay, or restore into an unvalidated environment. Preserve the facts needed for authorized responders, counsel, insurer, and forensics resources to evaluate the incident.

Recovery-entry criteria

Before restoration, authorized responders should confirm the recovery environment, evidence needs, backup integrity, priority systems, credentials, access controls, and validation steps. A successful restore is not enough; the environment needs appropriate validation before it returns to service.

Colorado notification caution

As of the date of attorney review, Colorado notification obligations should be evaluated with counsel using current primary authority and the facts of the incident. Technology staff should provide facts and records, not legal conclusions.

Offline decision card for an approved plan

• Use the approved incident contact list.

• Record the time, reporter, affected systems, and observed facts.

• Activate the authorized incident lead and technical responder.

• Contact insurer, broker, counsel, and forensics resources as the plan requires.

• Preserve evidence and wait for authorized containment and recovery decisions.

Service and agreement caveat

Automated monitoring does not by itself establish staffed after-hours response. Any Entice incident-response support, alert handling, escalation, or technical action must match a named approved service and the signed agreement.