Ransomware Readiness Checklist for Growing Companies
Ransomware readiness comes down to a few habits: tested backups, tight access, a clear response plan and practice. Here is a checklist growing companies can work through.
In this article
Ransomware remains one of the most disruptive threats a growing company can face. An attacker gets in, spreads quietly, then encrypts systems or steals data and demands payment. The damage often comes less from the first intrusion than from how long it takes to recover.
The good news is that readiness rests on a handful of habits that most companies can build. This checklist sets them out in a practical order. It will not stop every attack, but it makes an attack far less likely to succeed and far easier to recover from.
1. Backups you have actually tested
Backups are your last line of defence. If they work, you can restore without paying. If they do not, every other control matters less. Many companies discover during an incident that their backups were incomplete, out of date or reachable by the attacker.
Know what to back up.
List your critical systems and data, including cloud services, databases and file stores.
Keep a copy out of reach.
Hold at least one backup that the attacker cannot change or delete, such as an offline copy or an immutable storage setting.
Protect backup access.
Use separate accounts with multi-factor authentication for backup systems, so a compromised admin account cannot wipe them.
Test restores regularly.
Restore a real system from backup on a schedule and time how long it takes.
Write down the restore order.
Decide which systems come back first, so the business can operate while the rest are restored.
A backup that has never been restored is a hope, not a plan. The restore test is the step most often skipped and the one that matters most.
2. Access that is hard to abuse
Ransomware usually needs access to spread. Tightening access slows attackers down and limits the damage they can do.
Start with multi-factor authentication on email, remote access, cloud consoles and administrator accounts. Stolen passwords are a common way in, and a second factor blocks many of those attempts.
Reduce administrator rights. Give people the access they need for their role and no more. Use separate administrator accounts for privileged tasks, and review who holds them regularly.
Patch what faces the internet first. Remote access gateways, firewalls, email servers and public applications are frequent entry points. Keep them updated and remove services you do not need.
Look at how your network is arranged. A flat network lets an attacker move from one machine to everything. Separating critical systems makes that harder. Our infrastructure security assessments review cloud, network and identity settings for exactly these weaknesses.
Finally, protect endpoints. Modern endpoint protection, kept up to date and monitored, can detect and stop many ransomware attempts before they spread.
Train people too. Phishing remains a common way in, and staff who know how to spot and report a suspicious message give you an early warning. Keep the training short, practical and regular.
3. A response plan and a tabletop exercise
When an attack happens, the first hours decide a lot. A response plan written in advance avoids confusion and lost time.
Keep the plan short. Name the incident lead, the technical lead, the person who speaks to customers and the person who handles legal and regulatory duties. List the first actions: isolate affected systems, preserve evidence, assess what is affected and start recovery from clean backups. Store the plan and contact details where they remain available if your systems are down.
Include reporting duties. In India, the CERT-In directions require certain cyber incidents to be reported within 6 hours, and a personal data breach may also need to be reported under the DPDP Rules. Knowing these in advance prevents a missed deadline in the middle of a crisis.
Decide your position on payment ahead of time, with leadership and legal advice. Making that decision under pressure is much harder.
Then run a tabletop exercise. Walk the team through a realistic scenario, step by step, and note where people are unsure. Repeat it at least once a year. Each exercise improves the plan and builds confidence.
After each exercise, update the contact list, check that every named person still holds the same role and keep a printed copy of the plan somewhere safe.
Regular testing helps you find weak spots before attackers do. Our VAPT services article explains how penetration testing supports this work.
If you would like help working through this checklist, our infrastructure security assessments team is glad to help you find and fix the gaps.