Ransomware Recovery: 72-Hour Plan in 5 Phases

Main article: BCM under NIS2 — the full pillar article on this topic.

Reporting deadlines and practitioner windows: what applies when

In a ransomware attack, what is subject to statutory deadlines is the reporting chain; the five-phase structure of this article and its hour windows are practitioner recommendations that you adapt to your processes. The reporting obligation is triggered by a significant security incident within the meaning of § 2 no. 11 BSIG (in Austria § 35(1) NISG 2026, applicable from 1 October 2026); the definition and the quantitative criteria are set out in the FAQ. The 24-hour and the 72-hour deadline run from becoming aware of the incident, not from when it began; the one-month deadline attaches to the 72-hour report. In Germany the addressee is the joint reporting office of BSI and BBK; in Austria it is the competent sector-specific CSIRT and, where there is none, the national CSIRT, which forwards the report to the Cybersecurity Authority (§ 34(1) NISG 2026). Who is subject to the reporting obligation depends on classification as a particularly important entity or important entity (§ 28 BSIG) or as an essential entity or important entity (§ 24 NISG 2026) — the thresholds are set out in the FAQ.

The following table lists statutory reporting and notification obligations only, no practitioner values:

All statements on Austria in this article — the table column as well as phases 1 to 5 — only apply from the date the NISG 2026 becomes applicable on 1 October 2026 (§ 51(1) and (2) NISG 2026); the act has been promulgated since 23 December 2025 (BGBl. I Nr. 94/2025). Art. 33 GDPR applies in both countries irrespective of this. Where a data protection supervisory authority has already imposed a fine under the GDPR for the same conduct, an additional fine under the BSIG is excluded in Germany (§ 65(11) BSIG).

Phase 1: detection (0-2h)

Two decisions fall within the first two hours: is there a security incident — and who is in charge from now on? Triggers: endpoint alert, backup failure, user report. Added to this is an incident report from a service provider; cybersecurity contract clauses on supply chain security (§ 30(2) no. 4 BSIG) provide in practice for a maximum of 24 hours for this. Activate the crisis team: the roles for this are set out in the crisis management plan required by the mandatory area 'business continuity' (§ 30(2) no. 3 BSIG, in Austria § 32(4)(c) NISG 2026). Initial containment: isolate the network segment, take affected systems offline. In this phase, document the timestamp of becoming aware — it marks the start of the deadline for the 24-hour report (§ 32(1) no. 1 BSIG); the deadline under Art. 33(1) GDPR runs separately from the moment the personal data breach becomes known. Management belongs on the distribution list from the outset: in Germany, management itself is responsible for implementing and monitoring the risk management measures under § 38(1) BSIG and this responsibility cannot be delegated; in Austria it must ensure and supervise compliance under § 31(1) NISG 2026. The two-hour window is a practitioner recommendation; what is legally decisive is the point in time of becoming aware.

Phase 2: containment + BSI report (2-24h)

The early initial report must go out by hour 24 — in Germany to the joint reporting office of BSI and BBK (§ 32(1) no. 1 BSIG), in Austria as an early warning to the competent CSIRT (§ 34(2) no. 1 NISG 2026). The content of the German initial report includes, among other things, a statement on whether there is a suspicion of an unlawful or malicious act or whether cross-border effects are possible — with extortion software, both should be examined early. The initial report is not a full analysis: it is confirmed and updated in the 72-hour report (§ 32(1) no. 2 BSIG). The data protection track runs in parallel: where personal data are affected, the breach must be reported to the competent supervisory authority without undue delay and where feasible within 72 hours, provided that a risk to the rights and freedoms of natural persons is not unlikely (Art. 33(1) GDPR); where the report is made later, reasons for the delay must be given. Forensics starts imaging — before rebuilding, otherwise the evidence on cause and scope that belongs in the final report will be missing later. Bring in an external forensics firm (e.g. Mandiant or Crowdstrike) — the selection becomes decidable via three criteria: contractually agreed round-the-clock response time, documented evidence preservation with an imaging log, and references from your sector; you mandate legal counsel separately, not under the same contract. Practitioner recommendation: run the report and the forensics engagement in parallel, not one after the other, and place the second containment stage in this window — reset the passwords of domain administrators and service accounts, block VPN and remote maintenance access, disconnect backup repositories from the network; the initial isolation of the affected systems has already taken place in phase 1.

Phase 3: forensics + assessment (24-48h)

Between hours 24 and 48, the factual basis for the 72-hour report takes shape. In Germany this requires an initial assessment with severity, impact and, where available, indicators of compromise (§ 32(1) no. 2 BSIG); in Austria the same scheme applies under § 34(2) no. 2 NISG 2026. Identify the ransomware strain (e.g. LockBit, BlackCat). Check for data exfiltration: the result determines not only the report to the supervisory authority but also whether data subjects must be notified under Art. 34(1) GDPR — namely where the breach is likely to result in a high risk to their rights and freedoms. Find the point of entry: without it, the incident repeats itself after the restore. Do NOT pay ransom demands (BSI recommendation). Practitioner recommendation: record the assessment result and the reasoning in writing, including the decision that a criterion is not met — the final report will later ask about the type of threat and the root cause, and the supervisory authority can request an intermediate report at any time (§ 32(1) no. 3 BSIG).

Phase 4: recovery (48-72h)

Restoration only starts once the point of entry and the affected systems are known — otherwise the restore brings the encryption back. Restore from an immutable backup. What is legally required is the mandatory area of business continuity with backup management and disaster recovery (§ 30(2) no. 3 BSIG, in Austria § 32(4)(c) NISG 2026); the practitioner standard for the backup strategy is the 3-2-1 principle or an equivalent approach. Also legally required is the mandatory area of cryptography and encryption (§ 30(2) no. 8 BSIG, in Austria § 32(4)(h) NISG 2026); the practitioner standard for data at rest is AES-256 for storage media and backups. Complete reinstallation of all potentially compromised systems. Reconnection only after forensic clearance. Patching and hardening against the identified vulnerability, documented in the vulnerability management process (mandatory area of security in acquisition, development and maintenance, § 30(2) no. 5 BSIG). The 72 hours for critical systems are a practitioner target value. What is binding for your organisation is what the business continuity plan sets out as the recovery time objective and recovery point objective per business process — the recovery point objective names the maximum tolerated data loss, that is, the interval between two backups, and thereby determines the state you fall back to on restore; the test question is whether this interval is documented and tested per business process. Practitioner recommendation: switch administrator access and external access to multi-factor authentication before reconnection — in Germany it is a mandatory area in its own right (§ 30(2) no. 10 BSIG) and in Austria it is part of the catalogue in § 32(4) NISG 2026.

Phase 5: lessons learned (weeks 2-4)

The last statutory deadline runs in weeks 2 to 4: the final report at the latest one month after the 72-hour report (§ 32(1) no. 4 BSIG; in Austria the final report under § 34(2) no. 4 NISG 2026). It contains a detailed description, the type of threat and the root cause, the mitigation measures taken and ongoing, and where applicable cross-border effects. If the incident is still ongoing, a progress report takes its place first; the final report follows once the handling has been completed (§ 32(2) BSIG, in Austria § 34(2) no. 5 NISG 2026). Post-incident review workshop, action plan, update of the incident response plan: the findings belong in the same documents that feed the final report. ISO 27001 update: an existing ISMS covers large parts of Section 30 BSIG; what typically has to be added separately are the reporting obligations of 24h/72h/30d (§ 32 BSIG), supply chain due diligence under § 30(2) no. 4 BSIG, the management obligations of Section 38 BSIG and sector-specific particulars. Step up training — cyber hygiene and training are a mandatory area in their own right (§ 30(2) no. 7 BSIG, § 32(4)(g) NISG 2026), and management must regularly attend training itself (§ 38(3) BSIG, § 31(2) NISG 2026). Practitioner recommendation: include recovery time as a KPI in the quarterly reporting to management — this also feeds into the effectiveness assessment (§ 30(2) no. 6 BSIG).

What the 72h plan presupposes

A 72-hour plan only holds if four things are in place before the incident: tested backups, a business continuity plan with RTO/RPO per business process, a crisis management plan with named roles, and up-to-date contact details held by the supervisory authority. § 30(2) no. 3 BSIG (in Austria § 32(4)(c) NISG 2026) requires backup management, disaster recovery and crisis management; how this is designed is risk-based. The practitioner standard for this: a backup strategy following the 3-2-1 principle or equivalent, a disaster recovery plan with a tested restoration routine, a crisis management plan including internal and external communication. The fourth point is a formality with consequences: in Germany, as part of the registration under § 33(1) BSIG — in practice via the 'Mein Unternehmenskonto' portal — name, address and current contact details including email, public IP address ranges and telephone numbers must be submitted; registration must be carried out at the latest three months after the entity status arises, and the BSI points out that the statutory registration deadline has already expired. Changes must be notified without undue delay, at the latest within two weeks (§ 33(5) BSIG). In Austria, registration takes place with the Cybersecurity Authority within three months of the NISG 2026 entering into force on 1 October 2026, that is, by the end of 2026 (§ 29(2) and (3) NISG 2026). Practitioner recommendation: a quarterly tabletop exercise, feasible in four hours — 60 minutes of scenario and detection up to the documented timestamp of becoming aware, 60 minutes on the reporting decision using the prepared reporting templates for 24h/72h/30d, 60 minutes of recovery decisions (restore sequence, clearance by forensics), 60 minutes of evaluation with a list of measures and deadlines. The prepared templates are the core of the exercise: in a real case, drafting must not consume the deadline.