Can the plan be signed electronically?

Yes. Electronic signatures are legally valid under the ESIGN Act (15 U.S.C. §7001) and UETA where adopted, provided intent, consent, attribution, and record retention requirements are met.

Do ransomware plans require notarization?

Generally no. Notarization is rarely required for an incident response plan itself, though certain authorizations or powers of attorney used to approve payments might require notarization under state law.

How should evidence be preserved?

Isolate affected systems, capture images and volatile memory, export logs to write-once storage, and document chain-of-custody to support investigations and potential legal proceedings.

Who should sign the plan?

Primary signers typically include the CISO or head of security, general counsel or compliance officer, and an executive sponsor with budget authority to enable rapid decision-making.

Can I revoke or update an executed plan?

Yes. Update or replace plans by issuing a new version and capturing signatures for the updated document; retain prior versions per retention schedule for auditability.

What if a regulator requests records?

Respond promptly, preserve requested artifacts per legal hold, and coordinate with legal counsel; regulatory retention baselines include IRS and HIPAA rules as applicable.

Electronic Signature
Templates
Miscellaneous
Supplemental Ransomware Response Plan

Supplemental Ransomware Response Plan

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

SUPPLEMENTAL RANSOMWARE RESPONSE PLAN

THIS SUPPLEMENTAL RANSOMWARE RESPONSE PLAN (the Plan) is made effective as of by and between Client Name: and Service Provider: .

WHEREAS

WHEREAS, Client and Service Provider are parties to a Master Services Agreement or similar contract governing IT services and incident response, identified as Agreement Reference: ; and

WHEREAS, the parties desire to supplement existing obligations with a defined ransomware response plan to reduce business interruption, protect data, and coordinate communications and recovery; and

WHEREAS, this Plan sets forth the specific roles, processes, payment arrangements, reporting requirements, and confidentiality obligations applicable to ransomware incidents.

SCOPE OF WORK

Description of Supplemental Services

RESPONSIBILITIES AND CONTACTS

Lead Incident Responder (Service Provider):

Responder Contact Information Client Primary Contact for Incident Coordination

NOTIFICATION AND ESCALATION

Initial notification to Service Provider shall occur within of detection. Service Provider will acknowledge receipt within .

Escalation Timeline and Actions

CONTAINMENT, ERADICATION & RECOVERY

Containment and Eradication Procedures Data Recovery and Backups

Target recovery point objective (RPO): Target recovery time objective (RTO):

COMMUNICATIONS AND MEDIA

External Communications

Public statement approver:

TESTING, TRAINING AND EXERCISES

Planned frequency of tabletop or technical exercises: . Last full exercise conducted on: .

PAYMENT TERMS

Fee for supplemental ransomware response services: $.

Payment Schedule and Invoicing

Late payment shall accrue interest at or the maximum permitted by law, whichever is less.

TERM AND TERMINATION

This Plan commences on Start Date: and continues until End Date: unless earlier terminated as provided herein.

Either party may terminate for convenience upon days' written notice. Either party may terminate for material breach if the breach is not cured within days following written notice.

CONFIDENTIALITY

All nonpublic information disclosed in connection with a ransomware incident or this Plan shall be deemed Confidential Information. Recipient shall not disclose, use or permit access to Confidential Information except as necessary to perform obligations under this Plan, and shall protect such information with at least the same degree of care it uses to protect its own confidential information, but in no event less than reasonable care.

Disclosure required by law or compelled by a regulatory authority shall be permitted provided the disclosing party gives prompt notice to the other and cooperates to seek protective measures.

Acknowledgement of Confidentiality Obligations I acknowledge and agree to the confidentiality obligations set forth above.

COOPERATION WITH LAW ENFORCEMENT & INSURANCE

Parties shall cooperate with law enforcement, cyber insurance carriers, and regulators as reasonably requested. Client's cyber insurance carrier: ; Policy number: .

REPORTING, RECORDS & POST-INCIDENT REVIEW

Service Provider shall deliver a written incident report within days of containment. A post-incident review shall be conducted within days to identify remediation and lessons learned.

Post-Incident Deliverables

LIMITATIONS OF LIABILITY & WARRANTIES

Service Provider warrants that services will be performed in a professional and workmanlike manner consistent with industry standards. Except as expressly provided, all other warranties are disclaimed to the maximum extent permitted by law. Neither party shall be liable for indirect, incidental, special or consequential damages, except to the extent arising from willful misconduct or gross negligence.

GOVERNING LAW

This Plan shall be governed by and construed in accordance with the laws of the State of , without regard to its conflicts of law rules.

ENTIRE AGREEMENT

This Plan, together with the referenced Master Services Agreement, constitutes the entire agreement between the parties with respect to the subject matter and supersedes all prior and contemporaneous agreements and understandings, whether written or oral.

MISCELLANEOUS PROVISIONS

Amendments to this Plan must be in writing and signed by authorized representatives of both parties. Notices shall be delivered to the contacts listed in this Plan and shall be effective upon receipt.

Client

Party Label:

By:

Date:

Service Provider

Party Label:

By:

Date:

What the Supplemental Ransomware Response Plan Is

A Supplemental Ransomware Response Plan is a targeted addendum to an organization's broader incident response procedures that defines ransomware-specific detection, containment, evidence preservation, communication, legal reporting, recovery, and insurance coordination steps. It names roles and backups, specifies decision authorities for containment and potential payment, and documents technical controls, backup restoration procedures, and forensic requirements to support investigations and regulatory compliance in the United States.

Why a Supplemental Ransomware Response Plan Matters

A clear, documented plan shortens response time, preserves evidentiary integrity, clarifies legal reporting duties, and reduces uncertainty around authority and costs during an incident.

Teams and Roles That Should Maintain the Plan

The plan is intended for organizations with digital assets, sensitive data, or regulatory obligations; it aligns IT, legal, compliance, and leadership.

IT & Security Teams: Incident responders, SOC analysts, and engineers who will execute containment and recovery actions.
Legal & Compliance: Counsel and privacy officers who manage breach notifications, regulatory obligations, and evidence preservation.
Executive & Finance: C-level decision-makers and finance contacts authorized to approve vendor engagement and insurance claims.

Assigning primary and backup roles in advance reduces delays and prevents ad-hoc decision-making under pressure.

Core Components to Include in a Professional Plan

A complete supplemental plan groups technical, administrative, and legal actions into discrete sections so responders can act quickly and consistently.

Roles & Escalation

Named contacts, alternates, escalation thresholds, and emergency decision authorities for containment, third-party engagement, and potential payments.

Detection & Triage

Criteria for initial classification, immediate evidence capture steps, logging preservation, and urgent actions to limit lateral movement.

Containment & Eradication

Network segmentation actions, endpoint isolation procedures, credential resets, and timelines for safe eradication to minimize business impact.

Communications

Internal and external notification templates, stakeholder lists, role-based messaging, and pre-approved legal and public relations language.

Legal & Regulatory

Breach reporting obligations, evidence retention, law enforcement contacts, insurance notifications, and decision rules for ransom-related actions.

Recovery & Continuity

Backup restoration priorities, recovery time objectives (RTOs), validation checks, and post-incident validation and lessons-learned processes.

Step-by-Step: Preparing the Plan Before an Incident

Use this sequence to complete and approve the supplemental plan so it is actionable when needed.

01

Assess: Identify critical assets and regulatory exposures.
02

Assign: Designate primary, backup, and approver contacts.
03

Document: Capture technical playbooks and communication templates.
04

Approve: Obtain sign-off from legal, security, and executive sponsors.

Configuring an Online Approval and Signing Workflow

Set up a digital signing workflow to route, authenticate, and archive the plan and any emergency approvals with a clear audit trail.

Field	Configuration
Signer Roles	Role-based routing with primary and backup signers
Authentication	Email + SMS OTP or SSO for higher assurance
Notification Triggers	Immediate email and SMS upon assignment
Retention Policy	Automatic archiving with secure audit trail retention

How Online Submission and Signing Works

A concise eight-step workflow captures the document, routes signers, and preserves a signed record with authentication metadata.

Upload: Upload plan in PDF or DOCX format
Place Fields: Add signature, initials, date, and conditional fields
Authenticate: Signers verify identity via email, SMS, or SSO
Complete: Signed copies and audit trail are stored securely

Technical Requirements for eSubmission and Evidence Preservation

Ensure the chosen platform provides an immutable audit trail, secure storage, and integrations to export logs and artifacts for forensic review.

Integrations: Salesforce, NetSuite, Google Workspace, Box
File Formats: PDF/A, DOCX, and X.509-compatible signatures
Authentication: Email, SMS OTP, SSO, and advanced options

eSignature Vendor Comparison for Plan Approvals

Compare common eSignature plans and capabilities relevant to signing and archiving a Supplemental Ransomware Response Plan.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Yes	Yes	Yes	Yes
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No cap	100 env/user/yr	Varies	Varies	Varies

Security and Compliance Data to Record in the Plan

Encryption in Transit: TLS 1.2/1.3

Encryption at Rest: AES-256

Audit Trail: Detailed timestamp and IP logs

Certifications: SOC 2 Type II; ISO 27001

HIPAA Support: BAA available when required

21 CFR Part 11: Controls for FDA-regulated records

Primary Legal Risks and Penalty Considerations

Delayed Notification: State fines and litigation risk

Inadequate Evidence: Impeded investigation outcomes

Tax Reporting: IRC §6721 penalties for incorrect filings

I-9 Violations: Paperwork fines (8 CFR §274a.2)

HIPAA Breach: Civil penalties and corrective action

Intentional Missteps: Higher fines and criminal exposure

Common Preparation and Execution Mistakes to Avoid

Failing to preserve volatile logs and system snapshots immediately, which destroys critical forensic evidence for investigators.
Not naming alternates or backup approvers, leading to delays during nights, weekends, or executive unavailability.
Relying on informal payment authority without documented limits, increasing risk of unauthorized transfers or insurance disputes.
Using inconsistent templates across business units, complicating audits and slowing legal or regulatory response actions.

Key Incident Milestones From Detection to Review

Define milestone stages with owners and target timelines so the organization monitors progress and enforces SLA adherence.

01

Detection

Initial identification and triage of suspected ransomware activity

02

Containment

Short-term isolation and credential rotation to halt spread

03

Recovery

Restore systems per RTO priorities and validate integrity

04

Post-Incident Review

Root cause analysis, lessons learned, and plan updates

Recommended Reporting and Internal Deadlines

Set both statutory reporting obligations and internal targets to meet legal duties and restore operations efficiently.

Detection Window:

Target initial detection within 24 hours of compromise

Containment Target:

Contain lateral movement within 72 hours where feasible

Law Enforcement:

Notify relevant law enforcement promptly per agency guidance

Regulator Notification:

Follow state breach timelines, often 30–60 days

Insurer Notice:

Notify insurer according to policy—typically within 72 hours

Frequently Asked Questions About Using the Supplemental Ransomware Response Plan

Answers to common operational and legal questions about preparing, signing, and enforcing the plan in the United States.

Need help? Contact support

Can the plan be signed electronically?
Yes. Electronic signatures are legally valid under the ESIGN Act (15 U.S.C. §7001) and UETA where adopted, provided intent, consent, attribution, and record retention requirements are met.
Do ransomware plans require notarization?
Generally no. Notarization is rarely required for an incident response plan itself, though certain authorizations or powers of attorney used to approve payments might require notarization under state law.
How should evidence be preserved?
Isolate affected systems, capture images and volatile memory, export logs to write-once storage, and document chain-of-custody to support investigations and potential legal proceedings.
Who should sign the plan?
Primary signers typically include the CISO or head of security, general counsel or compliance officer, and an executive sponsor with budget authority to enable rapid decision-making.
Can I revoke or update an executed plan?
Yes. Update or replace plans by issuing a new version and capturing signatures for the updated document; retain prior versions per retention schedule for auditability.
What if a regulator requests records?
Respond promptly, preserve requested artifacts per legal hold, and coordinate with legal counsel; regulatory retention baselines include IRS and HIPAA rules as applicable.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now