Ransomware Protection Checklist for Businesses

1. Identity and remote access

• Use MFA for email, VPN, administrator accounts and cloud management portals.
• Use individual accounts and privileged roles instead of a shared administrator account.
• Disable unused accounts, former supplier access and exposed RDP services.
• Generate alerts for failed sign-ins, unusual locations and role changes.

2. Asset and patch management

An unprotected device is often a device that nobody has recorded. Maintain an inventory of hardware, operating systems, business applications and network devices, including their versions and owners. Define vendor notification, risk assessment, testing and deployment steps for critical vulnerabilities.

• Separate monitoring of internet-facing assets
• A replacement or isolation plan for systems that have reached end of support
• Security updates for firewalls, VPNs and virtualisation platforms
• Verification of versions and service health after patching

3. Network segmentation and visibility

A flat network makes it easier for a compromised account or device to reach other systems. Segment user computers, servers, production and OT devices, guest access, cameras and management interfaces according to business requirements.

• Allow only the required ports and resources between segments.
• Record the business owner, purpose and review date for each firewall rule.
• Prevent user and guest networks from reaching management interfaces.
• Retain DNS, identity, endpoint and firewall logs so that events can be placed on a common timeline.

4. Email, endpoints and user awareness

• Apply phishing and malicious attachment controls at the email layer.
• Monitor endpoint security tools for disabled protection or outdated status.
• Restrict macros, scripts and administrator privileges according to business needs.
• Show users how and where to report a suspicious message.

5. Backup and incident response

During an incident, the initial objective is to contain spread, preserve evidence and establish a safe recovery sequence. Reformatting every device immediately can undermine that work. Document contacts, decision authority, insurance and legal requirements, and the order of critical systems in advance.

• An offline or immutable backup copy
• Credentials for backup administration that are separate from the production environment
• Regular restore tests and startup tests in a clean environment
• An incident card containing isolation, notification and recovery steps

Priorities for the first 30 days

• Inventory internet-facing services and administrator accounts.
• Enable MFA for critical access.
• Verify backup deletion protection and complete a sample restore.
• Identify critical security patches and unsupported systems.
• Publish a basic incident contact list and isolation procedure.