Ransomware readiness comes down to a short list: offline tested backups, nothing risky exposed to the internet, strong authentication, limited privileges, segmentation, central logs and a plan you can run without your own network. This checklist follows CISA's #StopRansomware guide.
Backups and recovery
- Keep offline, encrypted backups of critical data and test restores regularly.
- Keep golden images and infrastructure as code templates so you can rebuild quickly.
- In cloud storage, turn on logging, delete protection, object lock and versioning.
CISA notes that some ransomware tries to delete or encrypt backups. A backup the attacker can reach is not a backup.
Reduce what attackers can reach
- Do not expose services such as RDP to the internet.
- Scan for vulnerabilities and patch quickly, putting internet facing systems and known exploited vulnerabilities first.
- Disable unused ports and protocols. CISA names disabling SMBv1 and blocking TCP 445 at the perimeter.
Authentication and privilege
- Use phishing resistant MFA, especially on email and VPN.
- Use unique passwords of at least 15 characters, and enforce lockouts.
- Keep admin accounts separate from user accounts.
- Limit local admin rights and audit accounts every quarter.
Network and logging
- Segment the network to slow lateral movement, and keep IT and operational technology apart.
- Keep domain controllers patched and lean, with restricted admin access and no internet access.
- Centralize logs and keep critical ones for at least a year where possible.
People and suppliers
- Train staff on social engineering.
- Assess the security of managed service providers and vendors, and limit their access to what they need.
- Filter email at the gateway, deploy DMARC and disable macros from email attachments.
The plan
- Keep a tested incident response plan and communications plan, with a hard copy and an offline version.
- Know who you report to. CISA lists CISA, the local FBI field office, IC3 or the Secret Service.
- Run a tabletop exercise on a ransomware scenario. See how to run a tabletop exercise.
CISA also lists a Ransomware Readiness Self-Assessment on its StopRansomware page, which is worth running once to check your own answers.
Where Safeguard fits
Several items on this list start with knowing what you have and what is exposed. Safeguard offers asset discovery and SBOM and dependency scanning, and the free scan at gold.safeguard.sh/scan shows dependency risk in a project. It does not replace backups or endpoint tooling.
Quick check
Which item gives the most protection per hour of effort?
Tested offline backups. Without them, every other decision during an attack is shaped by a ransom demand.
Is this checklist complete?
No. It is a summary of one guide. Read the full CISA document and fit it to your environment.
Sources
Last reviewed: 19 October 2026.
