Ransomware readiness is not a single product. It is the combination of preparation, access control, system maintenance, visibility, decision-making, and recovery capability.
Use this checklist to guide an internal discussion. A “no” or “not sure” answer does not automatically mean a crisis—it identifies an area that may deserve clearer ownership or deeper review.
Do not wait for an incident to decide who can authorize shutdowns, outside help, customer communication, or recovery priorities.
1. Know what the business cannot operate without
- List systems, applications, data, vendors, and devices that support essential operations.
- Identify acceptable downtime and data loss for the most important services.
- Document the people who understand each critical system and can make decisions about it.
2. Make backups useful for recovery
- Define which data and configurations are backed up and how often.
- Keep appropriate backup copies separated from ordinary production access.
- Monitor backup jobs for failures instead of assuming they completed.
- Test recovery procedures and record what was learned.
3. Reduce unnecessary access
- Require strong authentication for administrative and remote access.
- Use separate administrator accounts instead of ordinary daily-use accounts.
- Remove or disable accounts that are no longer needed.
- Review privileged access and important third-party access on a recurring schedule.
4. Keep systems and applications current
- Assign ownership for operating-system, application, firmware, and network-device updates.
- Track exceptions and systems that cannot follow the normal update process.
- Prioritize weaknesses that are actively exploited or affect important systems.
- Replace unsupported technology or document a temporary risk-reduction plan.
5. Improve visibility before you need it
- Decide which systems and security tools should generate alerts.
- Define who reviews alerts, when they are reviewed, and how urgent events are escalated.
- Protect useful logs from easy alteration and retain them long enough to support investigation.
- Watch for disabled protections, unusual account activity, and unexpected changes.
6. Prepare the response process
- Maintain a contact list for leadership, IT, legal counsel, insurance, communications, key vendors, and outside response support.
- Clarify decision authority before normal communication channels may be disrupted.
- Keep essential response information somewhere that remains available if core systems are offline.
- Practice a short scenario with business and technical stakeholders.
7. Plan the return to operation
- Prioritize which services should return first and what must be verified before reconnecting them.
- Identify clean systems, installation media, configurations, licenses, and credentials needed for restoration.
- Define how restored systems will be monitored for signs of continued compromise.
- Record decisions and improvements after exercises or real events.
Turn the checklist into owned work
For each gap, assign an owner, a realistic target date, and a way to verify completion. Start with items that affect essential services, recovery capability, or high-impact access.
This guide is general information. Your organization’s risk, legal, regulatory, insurance, and contractual requirements may require additional planning and professional advice.