Question

A mid-sized manufacturer suffers a confirmed ransomware incident affecting several production servers. The incident response manager is coordinating notifications. The company holds a cyber insurance policy that requires prompt reporting of covered events and pre-approval before engaging outside vendors or making ransom-related decisions. Which action should the IR manager prioritize to protect the organization's ability to recover costs under the policy?

Accepted Answer

Notify the cyber insurance carrier as soon as the incident is confirmed and before engaging third-party forensics or negotiators

Answer

Complete full eradication and recovery first, then submit a single consolidated claim to the carrier with all documentation

Answer

Engage a preferred external forensics firm immediately and notify the carrier after the investigation report is finalized

Answer

Post a public disclosure statement so the carrier can independently verify the event before processing the claim