The most effective ransomware prevention steps in CISA's guide are plain: keep tested offline backups, use multi-factor authentication, patch internet-facing systems quickly, keep remote desktop off the internet, and limit what each account can reach. A school can work through them in a term.
Backups come first
CISA advises offline, encrypted backups of critical data, tested regularly, plus "golden images" so machines can be rebuilt fast. Offline matters because ransomware tries to encrypt or delete backups it can reach.
Test one restore this month. Time it. If it takes four days, your plan for a Monday morning attack is four days of closed systems.
Close the front doors
- Do not expose remote desktop to the internet, and limit its use.
- Apply MFA to VPNs.
- Scan for vulnerabilities and patch promptly, starting with internet-facing systems and known exploited vulnerabilities.
- Disable the old SMBv1 file sharing protocol and block SMB ports at the perimeter.
If you run an older file server, ask your provider about the SMB point directly.
Protect accounts
CISA recommends phishing-resistant MFA for all services, especially email, VPNs and accounts on critical systems. It also recommends unique passwords of at least 15 characters, lockouts after repeated failures, and separate admin and everyday accounts.
The last one is cheap and powerful. A teacher account that cannot install software or change settings limits what a stolen password can do.
Reduce phishing damage
Train users to spot and report suspicious mail. Flag external email, filter at the email gateway, block risky attachment types, deploy DMARC and disable macros where you can. Most of this is a setting in your email platform.
Limit spread
Segment networks so a student lab does not sit on the same flat network as the finance office. Restrict user permissions. Keep logs centrally and, where possible, for at least a year.
Plan and rehearse
Write an incident response plan and a communications plan, and keep offline copies. Run a short tabletop exercise with the principal, the business manager and whoever manages IT. The question is simple: it is 7 a.m., students arrive in an hour, and nothing logs in. What happens?
Check your vendors
CISA recommends assessing managed service providers and giving them only the access they need. If a vendor holds a remote tool with admin rights over every school device, that tool is part of your risk.
Quick check
What single step matters most?
Tested offline backups. They turn a ransomware attack from a crisis about data into a recovery job about time.
Sources
Last reviewed: 19 October 2026.
