Who Makes the Ransom Decision, and When Do They Find Out?

The delegation of authority matrix in most enterprises runs from office supplies to acquisitions. It rarely has a line for extortion.

When a ransomware demand arrives, the threat actor’s countdown timer runs in hours. The enterprise procurement and board approval process runs in weeks. If these two clocks collide without a pre-approved bypass, the organization spends the first critical days arguing about how to spend money instead of recovering systems. The first payment question in a ransomware incident is usually whether anyone on the response call has the authority to answer it.

Three Decisions, Not One

Most organizations bundle the response into a single “ransom decision.” That is a mistake. There are three distinct decisions: negotiate, pay, and disclose. They require different authorities, operate on different clocks, and carry different risks.

• Negotiate: Engaging a firm to buy time and gather threat intelligence. This should be pre-authorized. You do not have to intend to pay to negotiate, and replying to a threat actor to buy time is a negotiation tactic that requires an authorized initiator.
• Pay: The financial and legal transaction. This requires the highest authority and is subject to external vetoes.
• Disclose: The regulatory and public communication. This runs on statutory clocks—SEC, HIPAA, state attorneys general, GDPR, contractual notice—that do not pause for negotiation.

Paying for a decryptor and paying for a promise not to release data are different decisions. If data is stolen, the disclosure decision dominates. Paying for deletion is a separate, usually worse, decision than paying for a key.

The Illusion of the CEO’s Decision

The CEO often assumes they make the final call to pay. In reality, outside breach counsel, the cyber insurance carrier, and sanctions screening dictate whether paying is a legal option. The CEO only gets to make the decision if the lawyers and insurers say yes first.

The insurer does not decide. The insurer vetoes. The cyber insurance policy likely contains a consent clause requiring prior written approval for any payment. You need to know the named approver, the after-hours path, and the exact form of written consent required before the incident happens. If the claims adjuster is two time zones away and the approval chain goes to a vice president who is unreachable, the carrier has effectively blocked the payment.

The board’s role is also frequently misunderstood. A board notification threshold is not the same thing as a board approval threshold. Convening the full board mid-incident produces minutes you will read again under subpoena. The board’s real role is to set the criteria beforehand, delegate authority to a small standing committee up to a specific dollar threshold, and ratify the outcome at the next scheduled meeting. The board sets the criteria and ratifies the outcome. It does not negotiate from a ski lodge.

The Hard Gates: Sanctions and the Money Path

Before a payment can be authorized, it must pass through external gates that operate independently of business logic.

Sanctions screening is not a formality. It is a gate, and it can close after you have decided to pay. Screening the threat actor’s wallet against the Office of Foreign Assets Control (OFAC) Specially Designated Nationals list is mandatory. If the screen turns red, payment is a federal crime. The screen must happen before payment, and the wallet must be re-screened if the attacker changes it mid-negotiation. The screen result, not the CFO, decides.

The money path is a separate project. You do not want your CFO trying to set up a corporate crypto exchange account on a Sunday night. Onboarding takes days. The acquisition path—whether through an exchange, an over-the-counter desk, or the incident response firm’s intermediary—requires know-your-customer compliance and treasury execution. Pre-clear this path and brief the treasury team before they are on the bridge line.

Designing the Authority

Closing the authority gap requires mechanical changes to your governance documents, done while the network is still running.

• Amend the Delegation of Authority: Add an extortion line with dollar bands, named roles, and backups. Name a quorum. If the primary approver is at a wedding or on a plane, the backup must be able to act.
• Keep Physical Copies: If your delegation of authority document and cyber insurance policy are stored on the SharePoint site that just got encrypted, you do not have a delegation of authority. Keep physical copies in binders at the homes of key executives.
• Pre-engage the Panel: The negotiation firm, sanctions screening firm, and breach counsel should all be under retainer with rate cards and named contacts. Contracting at hour six costs a day you do not have.
• Design Privilege Deliberately: Decide who engages the incident response firm. If outside counsel engages the firm, the reports flow to counsel under attorney-client privilege. The decision memo is either privileged or deliberately not. Decide which, on purpose, because you will live with it at deposition.

Conditions That Change the Answer

The decision to pay depends on the specific situation. A policy that says “payment is a last resort” has not assigned decision authority or defined the resort before it. Use these conditions to guide the decision:

• Short rebuild time: If the restore is measured in days, do not pay. The calculus changes when the restore is measured in months.
• Long rebuild, high daily revenue: Payment becomes plausible. The decision shifts to whether the business can survive the cash flow hit if the insurer denies coverage.
• Entity complexity: If the affected system belongs to a joint venture, a foreign subsidiary, or a portfolio company, the parent’s decision does not travel. Each entity has its own policy, board, and regulator.
• Safety or life impact: If patient care or physical safety is at risk, the decision shifts toward paying to restore, with less deliberation. Legal exposure does not disappear because the motive is good.
• Mid-deal environment: If M&A or financing is in flight, the decision set expands to deal counsel and the counterparty. Materiality and deal risk enter the room.

Executing the Decision

When the moment comes, the decision must be documented. Write a contemporaneous decision memo. It should state what is known and unknown about restoration, the affected systems, legal constraints, and the limits of what payment could accomplish.

The recovery estimate needs to come from the people testing restoration, not from the time remaining on the attacker’s clock. The decision record matters even when the answer is no, because it captures what the organization knew about restoration, data exposure, and legal constraints at the time.

Test the authority in your next tabletop exercise. Inject the demand at hour six, keep the clock running, and measure the time from the demand to a named approver saying yes or no. If it takes six hours to find an approver, that is the finding.