Recommendation 12

While the Government maintains that UK victims should not pay ransoms, it is the only viable option for many of those directly affected, enabling them to keep their businesses afloat and prevent damaging leaks of personal data. Too many organisational leaders are left to face this moral dilemma alone, without any state intervention. The NCSC must produce more detailed guidance—accessible to a non- technical audience—on how best to avoid the payment of ransoms after an attack, including negotiating techniques and sources of support for smaller organisations. (Paragraph 80) The strategic response — the Government’s structures and approach