Ransomware Readiness Checklist: 15 Things to Verify Before You Need Them

Most ransomware incidents do not start with a dramatic hack. They start with an unpatched VPN appliance, a password reused across three services, or an invoice attachment that was not an invoice. By the time somebody sees a ransom note, the decisions that mattered have already been made or missed. What follows is a checklist of fifteen things a small team can verify while the network is quiet. Work through it in an afternoon, fix what you can, and set a recurring reminder to go through it again every quarter.

Start With Backups You Can Physically Reach

Backups are the one control that lets you refuse a ransom demand. They also fail in predictable ways, usually because nobody ever restored from them or because they sat on the same network as everything else.

1. At least one copy is offline or immutable. Offline means genuinely disconnected: an external drive unplugged once the job finishes, a tape rotation, or cloud storage configured with object lock so nothing can delete it before the retention window closes. If your backup server is domain-joined with saved credentials, assume ransomware will encrypt it too.
2. You know the date of your last full restore test. Not a file-level recovery of a single spreadsheet. Restore an entire machine to clean hardware or a virtual machine and confirm the applications and data actually work afterwards.
3. Backup credentials are separate from daily admin accounts. The account that manages backups should not be the same one people use for email and file shares. Where possible, require a second person or a separate approval to delete backup sets.
4. You know your recovery point and recovery time. How much data can you lose without serious harm, and how many hours can the business be down? If the honest answer is "three days of retyping invoices," write that down as a decision rather than leaving it as a surprise.

Close the Doors Attackers Actually Use

Attackers rarely need clever techniques. They need one exposed service and enough time. The following five items cover most of the ways small organisations get in.

1. You have a list of everything reachable from the internet. VPN concentrators, firewalls, remote desktop gateways, mail servers, web applications, that forgotten test portal. You cannot patch or monitor what nobody has inventoried.
2. Remote Desktop is not exposed directly. Publish it behind a VPN or a gateway with multi-factor authentication, and restrict which accounts may connect. An RDP port open to the world attracts automated guessing within hours.
3. Multi-factor authentication is on email, VPN and admin consoles. Email deserves special attention because it is usually the reset path for every other account a person owns.
4. Everyday accounts are not administrators. Give staff standard user rights and use separate, clearly named admin accounts for changes. It turns a single compromised laptop from a whole-network problem into a contained one.
5. You have backups of configuration, not just data. Firewall rules, switch configurations, DNS records, licence keys, and the steps needed to rebuild your domain controller or file server. Keep a copy of critical credentials somewhere physically secure and offline, because the password manager may be the thing that is unavailable.

Make Reporting Faster Than Hiding It

The difference between a minor incident and a week of downtime is often measured in minutes, and minutes depend on whether people feel safe speaking up.

1. There is a one-click way to report a suspicious message. A button in the mail client, or a single address everyone knows by heart. Say plainly that false alarms are welcome and that nobody gets in trouble for reporting something that turns out to be harmless.
2. Everyone knows what "this looks wrong" means. Files getting renamed with odd extensions, a sudden crawl in performance, printers producing pages nobody sent, a lock screen demanding payment. Give examples during onboarding, not just during an annual slide deck.
3. Someone is on point, and someone else is their backup. Name an incident lead and a deputy. Keep an out-of-band contact list on paper or on personal phones, since email and chat are exactly what an attacker may control first.

If a team member hesitates to report because they think they will be blamed, you have already lost the first hour of your response.

Write Down What You Will Do in the First Hour

A recovery plan that exists only in someone's head disappears the moment that person is on holiday or unreachable. Keep it short enough to be read under pressure, and keep two copies: one in cloud storage, one printed.

1. One page covers the first sixty minutes. Who to call and in what order, which systems to disconnect, who informs staff, who speaks to customers, who contacts your insurer and, if appropriate, law enforcement.
2. You have decision rules instead of good intentions. Decide in advance when you will rebuild from scratch rather than clean an infected machine, who can authorise taking systems offline, and how you will handle a payment demand. On that last point, paying does not guarantee recovery and may carry legal or sanctions complications, so involve your insurer and a qualified legal adviser rather than deciding in the moment.
3. Templates for telling people exist already. A short holding statement for customers, a note for suppliers, and a message for staff explaining what to do and what not to do. Agree on one spokesperson so the story stays consistent.

Rehearse the Ugly Parts

Cheap insurance looks like ninety minutes in a meeting room with coffee. Pick a scenario — "the file server is encrypted on a Tuesday morning" — and walk the plan from step one, watching for gaps. Do you have a phone number for the person who manages the firewall? Does the printed plan list last year's office manager? Can somebody actually restore from that offline drive and prove it?

Then test the restores on a schedule, keep the checklist somewhere the whole team can find it, and review what went wrong after every near miss, not only after a real incident. You will never feel completely ready. Being prepared enough to make a few calm decisions in the first hour is what separates a bad week from a lost business.

Photo: Василь Вовк / Pexels