Ransomware has encrypted production and the attackers demand payment. How does the CISO approach the decision to pay?

Interviewers use this scenario to see whether a CISO treats ransom payment as a governance decision with legal consequences rather than a purely operational one.

Why counsel, law enforcement and sanctions checks come first

OFAC's updated advisory on ransomware payments explains that making or facilitating a payment can create sanctions risk, and that OFAC may impose civil penalties on a strict liability basis — meaning even an organization that didn't know the recipient was sanctioned can be exposed. The advisory treats as significant mitigating factors a full and timely, self-initiated report to law enforcement, cooperation with the authorities, and meaningful security practices in place before the attack. It encourages reporting incidents promptly to law enforcement and documenting security investments and the incident response.

A sound approach

1. Contain and assess the incident first; establish what is encrypted, what is exfiltrated, and what can be restored from backups.
2. Bring in legal counsel and the incident response team, and report to law enforcement.
3. Check sanctions exposure before any payment, and consider whether a licence is appropriate.
4. Decide on documented business impact, with the executive team and board informed; record rationale, options considered and who approved.

Why the distractors fail

• "Pay quietly" ignores strict liability: exposure doesn't depend on later attribution.
• "Refuse and stay silent" may skip regulatory, contractual and law enforcement reporting, and a blanket rule isn't a decision.
• "Delegate to IT" removes the legal, financial and reputational owners from a decision that is theirs.

What interviewers want

A calm, process-driven answer: legal and law enforcement involved early, sanctions checked, decision documented and owned at executive level.