Checklist · Response

Ransomware: readiness and first actions

What to have in place before it happens, and what to do in the first hours if it does.

Owner: Security lead and IT operationsTime: 1 hour to review, then twice a year

0 of 20

Reduce the ways in

No RDP, SSH or admin interfaces are exposed to the internet; remote access uses a VPN or access broker with MFA.
Internet-facing systems are patched within days for critical vulnerabilities, and the list of such systems is current.
Email filtering blocks dangerous attachments, and Office macros from the internet are blocked.
EDR covers all servers and laptops, and its coverage is measured, not assumed.
Administrators have separate accounts, and no daily-use account is a domain administrator.

The network is segmented so a workstation cannot reach every server and backup system.
Local administrator passwords are unique per machine.
Backups are encrypted, kept offline or immutable, use separate credentials, and a full restore was tested in the last six months.
The restore order for critical systems is written down, with estimated times.
Identity systems (directory, SSO) have a tested recovery plan, because everything else depends on them.

A printed or offline copy of the incident plan, contact list and system order exists, since email and chat may be down.
Roles are assigned for incident lead, IT, communications, legal and management.
Cyber insurance, incident response retainer and legal contacts are on the contact list, with the policy conditions understood.
Decisions about law-enforcement reporting and ransom are discussed with leadership and legal before any incident.

Isolate affected machines from the network; do not wipe them, because memory and logs are evidence.
Disconnect or protect the backups before anything else can reach them.
Disable compromised accounts and reset privileged credentials from a clean device.
Work out the entry point and scope before rebuilding, or the attacker returns.
Start the notification clock with legal: regulators, customers and insurers may have deadlines in hours.
Restore from known-good backups in the agreed order, scanning for the attacker's access before reconnecting.

Adjust it to your environment before relying on it. A finished list shows a routine was followed; it does not guarantee nothing was missed.

14-day free trial. No credit card. Cloud or on-premises.