What should a final ransomware assessment distinguish?¶

A final assessment should separate proved technical events, operational impact, offender claims, attribution, response actions and remaining uncertainty. “Hit by ransomware” is not an adequate evidential conclusion.

Give each major issue a bottom line¶

Address initial access, affected systems and accounts, persistence, movement, collection, exfiltration, encryption, backups, disruption, communications, payment, recovery and attribution. For each, state what is proved, strongly supported, possible and not established.

Keep distinct conclusions distinct: encryption is not theft; note branding is not group responsibility; payment is not proof of deletion. Explain retention gaps, response changes and alternative causes.

Separate technical recovery from closure¶

Systems may be restored while notification, financial tracing, victim impact and disclosure risk remain active. Identify completed and continuing workstreams, residual access and unassessed scope.

Record assumptions such as incomplete provider logs, uncertain data scope or unverified offender claims so later legal, regulatory and strategic users see the same limits.