Ransomware Readiness Checklist

Offline backups

Maintain offline (air-gapped) backups of critical data that cannot be reached by ransomware on the network.

Backup testing

Regularly test backup restoration procedures to verify data integrity and recovery time.

3-2-1 backup rule

Follow the 3-2-1 rule: 3 copies, 2 different media types, 1 offsite/offline copy.

Backup encryption

Encrypt backup data at rest and in transit to prevent exfiltration of backup contents.

Backup isolation

Ensure backup systems are isolated from the production network with separate credentials.

Multi-factor authentication (MFA)

Enforce MFA on all remote access, email, VPN, and privileged accounts.

Least privilege access

Apply least privilege principle: users and service accounts only have permissions they need.

Admin account audit

Regularly audit administrative accounts, disable unused accounts, and review privilege levels.

RDP restrictions

Disable or restrict RDP. If required, use VPN with MFA and network-level authentication.

Privileged Access Management (PAM)

Implement PAM solutions with session recording, just-in-time access, and credential vaulting.

OS patching

Apply operating system security patches within 14 days of release, critical patches within 48 hours.

Application patching

Keep all applications updated, especially internet-facing ones (Exchange, VPN appliances, web servers).

Firmware updates

Maintain firmware updates on network devices, firewalls, and IoT/OT devices.

Vulnerability scanning

Run regular vulnerability scans and prioritize remediation by CVSS score and exploitability (EPSS).

Email filtering

Deploy email security gateway with URL rewriting, attachment analysis, and impersonation protection.

DMARC enforcement

Implement SPF, DKIM, and DMARC (policy=reject) to prevent email spoofing of your domain.

Attachment sandboxing

Detonate suspicious attachments (Office macros, executables, archives) in a sandbox before delivery.

Security awareness training

Conduct regular phishing simulations and security awareness training for all employees.

Network segmentation

Segment the network to limit lateral movement. Isolate critical assets, OT, and backup systems.

EDR/XDR deployment

Deploy endpoint detection and response (EDR/XDR) on all endpoints with behavioral analysis enabled.

Network monitoring

Monitor network traffic for anomalies, C2 beaconing patterns, and unauthorized data transfers.

Firewall rules review

Review and harden firewall rules quarterly. Block unnecessary outbound traffic and known malicious IPs.

IR plan documented

Maintain a written incident response plan with specific ransomware scenarios and decision trees.

IR team identified

Designate an incident response team with clear roles, contact info, and escalation procedures.

IR plan tested (tabletop)

Conduct tabletop exercises or simulations at least annually to validate the IR plan.

Communication plan

Prepare communication templates for stakeholders, legal, law enforcement, and media in case of ransomware.