UK Ransomware Payment Ban: What CISOs Must Do to Prepare Now

The UK government is progressing legislation to ban ransomware payments for CNI operators and public sector bodies — and CISOs must prepare now before the safety net is removed.

What Is the UK Ransomware Payment Ban and How Far Has It Progressed?

In January 2025, the Home Office launched a formal consultation on three legislative proposals to reduce the ransomware threat to the UK economy: a targeted ban on ransomware payments for critical national infrastructure (CNI) operators and the public sector; a ransomware payment prevention regime applicable to all organisations; and a mandatory incident reporting regime for ransomware attacks. The consultation received 273 responses and produced a notably strong mandate — approximately 75% of all respondents expressed support for the payment ban. The government has since published its response confirming that if progressed, this package would represent the first specific measures in UK law directly targeting ransomware.

According to NCSC CEO Richard Horne, speaking in response to the consultation: “This consultation marks a vital step in our efforts to protect the UK from the crippling effects of ransomware attacks and the associated economic and societal costs.” The NCSC’s position is unambiguous — paying ransoms funds criminal organisations, funds future attacks and provides no guarantee of data recovery or system restoration. The legislative direction of travel is clear: paying ransoms will become significantly harder, and for CNI operators and the public sector, potentially illegal.

Executive Action

• Brief your board and executive committee on the ransomware payment legislative proposals and their strategic implications — if your current incident response plan includes ransom payment as an option, that option may be removed by statute.
• Monitor the legislative timetable via the Home Office and the UK Cyber Security and Resilience Bill — ransomware payment provisions may be incorporated into primary or secondary legislation.
• Engage your legal counsel and cyber insurance provider now to assess how the proposed legislation would affect your current cyber policy terms — ransom payment coverage may become void for in-scope entities.

Who Does the UK Ransomware Payment Ban Apply To — and Who Faces the Prevention Regime?

The targeted payment ban, as proposed, applies to owners and operators of regulated critical national infrastructure and the public sector. In the UK, CNI sectors include financial services, energy, water, transport, communications, health, food, defence and government. For CISOs in these sectors, the message is stark: ransom payment is the option that legislation intends to remove. The proposal recognises that CNI operators and public sector bodies are disproportionately targeted by ransomware actors precisely because the consequences of operational disruption — and the perceived willingness to pay — make them high-value targets. Removing the payment option is intended to reduce that targeting incentive.

For organisations outside the CNI perimeter, the ransomware payment prevention regime would apply. Under this proposal, any organisation wishing to make a ransomware payment would first be required to notify the government — creating a mandatory notification step before payment is made, not simply after an attack has occurred. This represents a fundamental change to incident response decision-making timelines: where CISOs currently have operational discretion on payment decisions, the prevention regime would insert a government notification and review step into that process.

Executive Action

• Confirm whether your organisation is classified as a CNI operator under UK government designations — if so, ransom payment will be prohibited and your incident response plan must be rebuilt without it as an option.
• If outside CNI scope, redesign your ransomware incident response plan to incorporate a mandatory government notification step before any payment decision — build this into tabletop exercises now.
• Review your cyber insurance policy terms for ransomware coverage: if the prevention regime or ban becomes law, insurers may exclude payments that violate statutory requirements — verify your policy wording with your broker.

What Does the Mandatory Incident Reporting Regime Mean for CISOs?

The third proposal — mandatory ransomware incident reporting — would require organisations to report ransomware attacks to a designated government body within a specified timeframe, regardless of whether a payment was made or contemplated. This creates a new disclosure obligation that sits alongside, and in some cases overlaps with, existing obligations under UK GDPR (ICO notification for personal data breaches), the Network and Information Systems (NIS) Regulations (for operators of essential services), and DORA (for financial entities in scope).

For CISOs, the mandatory reporting regime changes incident response in two ways. First, it makes confidential incident management — a common approach where organisations contain, remediate and disclose selectively — significantly harder to sustain. Second, it creates a government-held dataset of ransomware incidents that the NCSC intends to use for threat intelligence, coordinated response and adversary disruption. According to the Home Office consultation document, the reporting regime is designed to give government the visibility needed to act against ransomware actors at a national level — a goal that requires broad industry participation to be effective.

Executive Action

• Map your existing incident reporting obligations (ICO, NIS, DORA, FCA) and identify where a new mandatory ransomware reporting requirement would create additional or overlapping timelines — build a unified reporting framework now.
• Update your ransomware incident response playbook to include a mandatory government notification step and test it in a tabletop exercise before legislation is enacted.
• Engage your board and General Counsel on the reputational and legal implications of mandatory ransomware disclosure — the decision to report is no longer purely operational once a statutory obligation exists.

How Should CISOs Build Ransomware Resilience Without Relying on the Payment Option?

For CISOs in CNI sectors, the payment ban removes what many organisations have treated — explicitly or implicitly — as a last-resort recovery option. Building ransomware resilience that does not depend on payment requires investment across five domains: detection speed (the faster an attack is detected and contained, the less data is encrypted and the lower the recovery cost); backup architecture (air-gapped, immutable backups that cannot be encrypted or deleted by ransomware actors, tested for recovery speed against realistic attack scenarios); incident response capability (an exercised, documented response playbook with defined decision authorities and pre-agreed external support contracts); supply chain security (most ransomware enters through compromised suppliers and third parties, not direct attacks on the target); and recovery planning (defined recovery time objectives for critical systems, with board-approved investment to meet those objectives).

According to the NCSC’s ransomware guidance for UK organisations, the single most effective technical control against ransomware impact is a tested, air-gapped backup capability combined with network segmentation that limits lateral movement. CISOs who have not tested backup recovery at realistic scale — including verifying that backups were not encrypted before the attack was detected — are operating with a theoretical resilience position that may not hold under real attack conditions. The INFORMD cyber resilience assessment tool provides a structured framework for benchmarking your ransomware resilience posture. Access the executive briefing library for DORA and operational resilience briefings relevant to financial sector CISOs.

Executive Action

• Test your air-gapped backup recovery capability against a realistic full-encryption ransomware scenario — do not assume backups are intact and recoverable until you have verified it under exercise conditions.
• Conduct a network segmentation review to confirm that lateral movement from an initial compromise to your critical systems requires adversary effort that your detection controls can identify and interrupt.
• Establish pre-contracted ransomware incident response retainer agreements with a specialist firm — negotiating support in the middle of an active attack is both slower and more expensive than having retainer terms in place.

What Must CISOs Present to Their Board Before Ransomware Legislation Is Enacted?

The ransomware payment proposals create a board-level governance question that CISOs must surface now — before legislation is enacted. Boards in CNI sectors and the public sector must understand that their current cyber risk strategy may assume ransom payment as an available recovery mechanism, and that this assumption will be unlawful once the ban is in force. Boards that have not been briefed on the legislative direction of travel are making risk appetite decisions based on an incomplete picture of the regulatory environment.

The board presentation should address four questions: What is the organisation’s current ransomware resilience position without recourse to payment? What investment is required to bring resilience to a level that renders payment unnecessary? What is the current cyber insurance position regarding ransom coverage and how may it change? And what is the mandatory reporting obligation under the proposed regime and its reputational implications? Use the INFORMD board report template to structure your ransomware risk presentation for board approval of the necessary resilience investment. Contact the INFORMD team for advisory support on board-level cyber risk briefings.

Executive Action

• Present a ransomware risk briefing to your board that explicitly addresses the proposed payment ban and its implications for current incident response planning and cyber risk strategy.
• Secure board approval for the investment required to achieve payment-independent ransomware resilience — frame this as a regulatory compliance investment, not a discretionary security upgrade.
• Review and update your cyber risk register to reflect the legislative proposals as an emerging regulatory risk, with a defined programme owner and target completion date for gap remediation.

INFORMD provides intelligence briefings, tools and frameworks for senior business leaders across technology, finance, strategy and compliance. Based in Milton Keynes, UK, we help executives stay informed and act with confidence. Explore our full briefing library or access our free assessment tools.

Stay ahead. Subscribe to INFORMD’s weekly executive briefing at informd.co.uk.