Prepare the ransomware payment report within 72 hours
Key facts
- Human involvement
- YellowClose supervision
- How AI is used
- From the incident timeline, the payment record and the extortion communications, populate the reporting form fields: the reporting entity, when the payment was made or became known, the amount and method, the attacker’s demand and communications, and the incident details known so far, with each field cited to its source record.
- What the lawyer must review
- The lawyer decides whether the business is a reporting business entity, whether the payment was made by or on behalf of it, when the 72 hours started, and whether paying raised a sanctions or other legal risk that changes what is reported or to whom, then checks every field before submission.
- Written for / version
- US
Open a jurisdiction version of this task to see which instruments apply: US
Who does what
| Role | What they do |
|---|---|
| Assistance | From the incident timeline, the payment record and the extortion communications, populate the reporting form fields: the reporting entity, when the payment was made or became known, the amount and method, the attacker’s demand and communications, and the incident details known so far, with each field cited to its source record. |
| Lawyer | Set the scope, supervise the work closely, verify every part relied on, resolve omissions and exceptions, and approve the exact output. |
Checklist
- Confirm the previous financial year’s turnover meets the $3 million threshold, or that another basis for reporting applies.
- Fix the start of the 72 hours from the payment or the time the entity became aware of it, and record which.
- Check the payment details against the bank or wallet record, not the incident summary.
- Screen the recipient of the payment against the Consolidated List and record the result.
Sources
These are suggested working checks. Confirm the required checking with the responsible lawyer before work starts; the checking approach does not establish permission to use AI.