Ransomware is a business continuity problem as much as a security problem. When it hits, the questions that matter are simple: Can we keep operating? Can we get our data back? Do we know who to call and what to do?
No single product prevents ransomware. Readiness comes from layered controls that make an attack harder, limit how far it spreads, and make recovery possible without paying. This guide walks through those layers and gives you a way to assess where you stand.
Backups: your last line of defense
If everything else fails, backups decide whether you recover in days or face a much harder choice. Attackers know this, which is why they often go after backups first.
Follow the 3-2-1 rule
- 3 copies of important data (production plus two backups)
- 2 different types of storage or media
- 1 copy offsite, physically or logically separated from your main environment
Many organizations now extend this with an immutable or offline copy and with verified, error-free restores. Whatever you call it, the idea is the same: at least one copy an attacker can’t reach or change.
Make at least one copy immutable
Immutable backups can’t be modified or deleted for a set retention period, even by an administrator. That matters because attackers who gain admin credentials will try to delete backups before deploying ransomware.
- At least one backup copy is immutable or offline
- Backup systems use separate credentials from the main domain
- Access to backup consoles requires MFA
- Retention is long enough to recover from before an attacker got in, not just the day before encryption
Test restores, not just backups
A green checkmark on a backup job tells you the job ran. It doesn’t tell you the data can be restored, or how long it will take.
- Restores are tested on a schedule, including full systems, not just individual files
- Results are documented, including how long recovery took
- Recovery time and recovery point objectives are defined for critical systems
- Cloud data (Microsoft 365, Google Workspace, SaaS applications) is backed up separately from the provider’s built-in retention
Multi-factor authentication everywhere it matters
Stolen credentials are one of the most common ways attackers get in. MFA makes a stolen password far less useful.
Prioritize MFA on:
- Email and collaboration platforms
- Remote access (VPN, remote desktop gateways, remote support tools)
- All administrator and privileged accounts
- Backup systems and management consoles
- Cloud platforms and line-of-business applications that hold sensitive data
- Financial and banking systems
Where possible, use phishing-resistant methods such as FIDO2 security keys or passkeys for administrators. Authenticator apps with number matching are a reasonable step up from SMS codes.
Patching and vulnerability management
Attackers routinely exploit known vulnerabilities in internet-facing systems: firewalls, VPN appliances, remote access tools, and email servers.
- Operating systems and third-party applications are patched on a defined schedule
- Critical vulnerabilities on internet-facing systems are patched on an accelerated timeline
- Firewalls, VPN appliances, and network equipment firmware are included in patching
- Systems past end of support are identified and replaced or isolated
- Vulnerability scans run regularly and findings are tracked to closure
- Unnecessary internet-exposed services (such as open remote desktop) are shut off
Endpoint detection and response (EDR)
Traditional antivirus looks for known bad files. EDR watches behavior, such as unusual processes, credential theft attempts, and mass file encryption, and can isolate a device automatically.
- EDR is deployed on every workstation and server, with coverage reports to prove it
- Someone monitors and responds to alerts around the clock, whether in-house or through a managed detection and response (MDR) service
- Tamper protection prevents attackers from disabling the agent
- Response actions, such as isolating a device, are defined and tested
EDR without someone watching it is a smoke detector with no one home.
Email security and user awareness
Email remains a primary delivery method for malware and credential phishing.
- Advanced email filtering scans links and attachments
- SPF, DKIM, and DMARC are configured for your domains
- External emails are tagged so users can spot them
- Macros from internet sources are blocked by default
- Users receive regular security awareness training and phishing simulations
- There is an easy, well-known way for users to report suspicious messages
Limit how far an attack can spread
Assume something will eventually get through. Good architecture contains the damage.
- Users don’t have local administrator rights on their workstations
- Admin accounts are separate from everyday accounts and used only for admin tasks
- The network is segmented so a compromised workstation can’t reach everything
- Service accounts have only the permissions they need
- Logs are centrally collected and retained long enough to investigate an incident
Incident response plan
When ransomware hits, decisions get made fast and under pressure. A written plan prevents the worst mistakes.
What the plan should cover
- Roles. Who leads, who makes business decisions, who communicates, and who handles technical response.
- Contacts. IT provider, cyber insurance carrier, breach counsel, forensics firm, and law enforcement contacts, kept somewhere that doesn’t depend on your network.
- First steps. How to isolate affected systems without destroying evidence.
- Insurance notification. Many policies require prompt notice and use of approved vendors. Know the process before you need it.
- Communication. How to reach staff, clients, and partners if email is down.
- Legal and regulatory obligations. Breach notification requirements that may apply to your industry and the states where you operate.
- Recovery priorities. Which systems come back first, and in what order.
Test it
- The plan is written and accessible offline
- Leadership has walked through it in a tabletop exercise
- Contact information is current
- Lessons from exercises are used to update the plan
Cyber insurance questionnaires
Cyber insurance applications increasingly ask detailed questions about your controls. Many of them map directly to the items in this guide: MFA coverage, EDR, backup immutability and testing, patching cadence, privileged access, and incident response planning.
Treat the questionnaire seriously:
- Answer accurately. An inaccurate answer can create problems when you file a claim.
- Involve your IT provider. The person filling out the form should understand the technical questions.
- Keep evidence. Save documentation that supports each answer.
- Use it as a roadmap. If you can’t answer “yes” to a question, that’s often a control worth adding.
Quick self-assessment
Answer yes or no. Every “no” is a gap worth closing.
- We have an immutable or offline backup copy
- We’ve restored a full critical system from backup within the past several months
- MFA is enforced on email, remote access, and all admin accounts
- Internet-facing systems are patched promptly
- EDR is on every device and monitored around the clock
- Users don’t have local admin rights
- We have a written, tested incident response plan
- We know exactly how to notify our cyber insurer
How we can help
We assess ransomware readiness against these controls and give you a prioritized list of what to fix first. From there, we can implement and manage the backups, MFA, EDR, and response planning so you’re ready before you need to be.