The resilient baseline
- Reduce easy entry through MFA, supported software, limited remote access and user reporting.
- Know which devices and accounts are protected; route alerts to a responder.
- Keep recovery copies away from the same credentials and test a real restore.
- Practice isolation and decision rights before an incident.
Last updated: September 25, 2026
Ransomware can mean encryption, data theft, service disruption or several of these together. No product guarantees prevention. CISA's StopRansomware Guide combines prevention, response and recovery; its checklist calls for isolating affected systems and maintaining offline or otherwise protected backups. Use the first-30-minutes page if an incident is happening now.
Prevent common entry paths
Inventory internet-facing remote access, administrator accounts and supported devices. Require MFA for email, privileged and remote access; close unused routes. Patch operating systems, browsers and applications with an exception owner and priority based on exposure. NIST SP 800-40r4 describes patching as preventive maintenance, including verification after installation. Train staff to report suspicious messages and unexpected MFA prompts through a channel they can use quickly. Review supplier access and remove it when work ends.
Detect and contain without guessing
Reconcile endpoint coverage against the asset list. Check whether the current security agent is healthy and whether an alert reaches a named person after hours. Record who may disconnect a laptop, isolate a network segment, disable an account or contact the IT provider. Do not assume a console's “protected” badge proves a real response path. The endpoint protection guide provides a pilot matrix and checks existing entitlements before another EDR purchase.
| Signal | Owner's first question | Evidence |
|---|---|---|
| Suspicious encryption or ransom note | Which devices or shares are affected? | Device list, earliest alert and isolation record |
| Unusual administrator sign-in | Can the account still reach critical systems? | Sign-in log, session revocation and MFA review |
| Backup deletion or failure | Are independent recovery copies intact? | Access log and isolated restore test |
| Staff report of a malicious attachment | Did it execute or reach others? | Message, endpoint alert and responder decision |
Make recovery credible
Define the critical workflows and acceptable data loss and downtime with the business owner. Map which systems, credentials and vendor services they depend on. Keep at least one recovery path that an attacker using a compromised production administrator account cannot easily erase. Test a restore into a clean location, verify that staff can use the recovered data and record the actual time. A green backup dashboard is not a tested recovery. The backup strategy guide covers scope and validation.
Practice the response sequence
If ransomware is suspected, isolate known affected systems and call the incident lead through a trusted channel. Preserve available evidence and timeline. Protect identity and backup systems before restoration. Ask the insurer, legal adviser and law enforcement about case-specific reporting and payment decisions. Follow the incident-response plan; do not wipe or reconnect devices from a generic checklist alone. NIST SP 800-61 Rev. 3 integrates response and recovery with ongoing risk management.
A 90-day rollout
In days 1–30, inventory critical assets and admin routes, turn on MFA, appoint an alert owner and check backup scope. By day 60, close patch/coverage gaps, protect recovery copies and test one restore. By day 90, rehearse an incident, test off-hours escalation and fund unresolved exceptions. Use the 90-day roadmap to track owners and evidence.
Buying gate
New endpoint, backup or response services should be justified by a failed coverage, restore or escalation test. Compare the exact license unit, supported platforms, service hours and renewal terms; do not buy a second tool to compensate for an unassigned owner.
Sources checked September 25, 2026: CISA StopRansomware Guide, NIST SP 800-40r4, and NIST SP 800-61r3. This page is documentation-based guidance, not a measured prevention claim.