Cybersecurity Policy Report, Portugal Signs Onto International Guidance Discouraging Ransomware Payments, (Aug 1, 2025)

By Tony Foley

Portugal’s National Cybersecurity Centre (CNCS) has signed on to guidance developed as part of an international initiative to combat ransomware.

In a news release announcing the action, CNCS said the guidance would discourage ransomware attacks and was based on a collaborative approach with insurance companies, focusing on the role they play in resilience and protection against cybersecurity incidents.

The “Guidance for Organizations During Ransomware Incidents,” developed by the Counter Ransomware Initiative (CRI), aims to assist organizations in responding to a ransomware incident and reducing disruption and costs to businesses, the number of ransoms paid by ransomware victims, and the size of ransoms that victims choose to pay. It also emphasizes the important role that cyber insurance can play in helping to build resilience to attacks (CPR, Nov. 2, 2023).

The guidance, which is nonbinding and does not override specific laws and regulations that may apply across member jurisdictions, outlines issues that organizations should consider before deciding whether to make a ransomware payment to a cyber criminal group, including the following:

1. Consider the correct legal and regulatory environment around a ransom payment;

2. Report incidents to the authorities;

3. Evaluate all options, exercising due diligence and an analysis of the potential harms;

4. Consult experts, like insurers, national technical authorities, law enforcement, or cyber incident response companies familiar with ransomware incidents;

5. Review alternatives to paying a ransom, which should be informed by a comprehensive understanding of the impact of the incident and whether payment is likely to change that outcome;

6. Gather relevant information to assess the impact and legal obligations of a ransom payment, including considering the technical situation, and putting workarounds in place to manage business disruption;

7. Assess the impact of the incident to be better prepared to respond and to have discussions regarding insurance coverage;

8. Record the decision-making process to create an auditable trail for each decision made;

9. Involve necessary stakeholders in ransomware decisions, including technical staff and senior decision makers; and

10. Be aware that payment of a ransom does not guarantee access to an organization’s devices or data.

The guidance further recommends that organizations conduct a post-incident evaluation to investigate the root cause of an incident and to make the necessary preparations to avoid a repeat attack.

News: InternationalLegislation DataSecurity