🚨Interactive Checklist
Ransomware Preparedness Checklist
Verify readiness to prevent, detect, and respond to ransomware attacks.
25 items0%
Critical items (marked ★) carry higher weight. Focus on Prevention & Hardening and Backup & Recovery first — these have the highest impact on ransomware resilience.
Prevention & Hardening
Reduce the attack surface and prevent initial compromise.
0/5
Multi-factor authentication (MFA) is enforced on all remote access, privileged accounts, and email systems.★ Critical
Endpoint detection and response (EDR) is deployed on all endpoints including servers.★ Critical
Network segmentation isolates critical systems (e.g., backups, AD, OT) from general user networks.
Email filtering with attachment sandboxing and URL rewriting is in place.
Vulnerability management programme patches critical vulnerabilities within 72 hours of disclosure.
Detection & Response
Detect ransomware activity early and respond before encryption spreads.
0/5
A 24/7 security monitoring capability (internal SOC or managed detection and response) is operational.★ Critical
Ransomware-specific detection rules are deployed (e.g., mass file renames, shadow copy deletion, known ransomware IOCs).
An incident response plan specific to ransomware has been documented and tested within the past 12 months.★ Critical
Network isolation procedures can quarantine affected segments within 30 minutes.
Threat intelligence feeds are integrated into detection tools to identify emerging ransomware variants.
Backup & Recovery
Ensure data and systems can be restored without paying a ransom.
0/5
Immutable or air-gapped backups exist for all critical systems and data.★ Critical
Backup restoration has been tested end-to-end within the past 90 days with documented recovery times.
Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) are defined and achievable for Tier 1 systems.
Backup credentials are separate from production Active Directory and stored in a break-glass process.
A clean-room recovery environment is available to rebuild systems without reintroducing malware.
Organisational Readiness
Prepare leadership, legal, and communications for a ransomware event.
0/5
Executive leadership and the Board have participated in a ransomware tabletop exercise within the past year.
A pre-negotiated retainer with an incident response firm is in place.
Legal counsel has provided guidance on ransom payment policy, regulatory reporting, and law enforcement engagement.
Crisis communication templates are prepared for customers, employees, regulators, and media.
Cyber insurance policy covers ransomware, business interruption, and incident response costs, and has been reviewed within the past year.
Post-Incident
Learn from incidents and continuously improve ransomware defences.
0/5
A formal post-incident review process is defined that captures root cause, timeline, and remediation actions.
Lessons learned from exercises and real incidents are tracked to closure in a remediation backlog.
Threat modelling is updated after each incident or major threat intelligence update.
Ransomware readiness metrics are reported to the Board at least quarterly.
Third-party penetration testing includes ransomware simulation (e.g., assumed breach, lateral movement testing).