Insights · Checklist
Ransomware readiness checklist
Ransomware is the scenario most likely to close a business for days and the one insurers ask about first. This checklist covers prevention, isolated recovery, rehearsed response and the decisions that should never be made for the first time during an attack.
How to use it
Before the first step.
- Evidence for each step is what an insurer or customer will ask for.
- Steps marked not done become the remediation plan.
Steps
Each one owned and evidenced.
| # | Step | Owner | Evidence |
|---|---|---|---|
| 01 | Deploy phishing-resistant MFA for administrators, remote access and email; conventional MFA everywhere else at minimum. | IT lead | Coverage report by population |
| 02 | Deploy endpoint detection and response on every device; confirm coverage and alert handling. | IT lead | Deployment report and alert process |
| 03 | Patch internet-facing and critical systems within defined timelines; close or protect exposed remote access. | IT lead | Patch and exposure report |
| 04 | Remove standing administrative privilege; vault and monitor privileged accounts, including vendor and service accounts. | IT lead | Privileged account inventory |
| 05 | Segment the network so that workstations cannot reach servers and backups freely. | IT lead | Segmentation documentation |
| 06 | Maintain immutable or offline backup copies with separate credentials; confirm attackers with admin access cannot delete them. | IT lead | Backup isolation evidence |
| 07 | Restore a critical service end to end from backup and record the time. | IT lead | Restore test record |
| 08 | Filter email and web traffic for malicious content; train staff and test with simulations. | IT lead with HR | Filtering configuration and training records |
| 09 | Monitor for the precursors: credential misuse, unusual access, disabled security tools, mass file changes. | Security operations | Detection rule inventory |
| 10 | Prepare the response: playbook, contacts for counsel, forensics, insurer and law enforcement, and evidence preservation. | Security lead | Playbook and contact records |
| 11 | Decide in advance, with counsel and the insurer, the organization’s position on payment and the approval route. | Executive sponsor with counsel | Decision record |
| 12 | Prepare notification obligations and communication templates for customers, regulators and staff. | Counsel with communications | Templates and obligation register |
| 13 | Exercise the scenario with leadership in a tabletop; drill the restore. | Security lead | Exercise and drill records |
| 14 | Review cyber insurance requirements against the above and close gaps before renewal. | Risk lead | Insurance evidence pack |
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days