A CISO or legal counsel facing an active ransomware extortion demand needs a structured decision framework to evaluate whether to pay, negotiate, or refuse — accounting for legal exposure, business continuity, cyber insurance policy terms, and law enforcement reporting obligations. Time pressure and emotional urgency make objective analysis nearly impossible without a structured aid.