The strongest ransomware defenses are offline tested backups, a rehearsed response plan, patched and not exposed remote access, multi-factor authentication, least privilege access, vulnerability scanning, phishing controls and staff reporting. Ten of them are below, each taken from the joint CISA and MS-ISAC #StopRansomware Guide.
Where do these ten come from?
The guide was developed through the Joint Ransomware Task Force and updated in September 2023 from the 2020 edition. It is based on operational insight from CISA, MS-ISAC, NSA and the FBI. Part 1 covers prevention organized around common initial access vectors. Part 2 is a response checklist. The recommendations map to CISA's Cross-Sector Cybersecurity Performance Goals.
The ten defenses
1. Keep offline, encrypted backups and test them. The guide says many variants look for backups to delete or encrypt, so restoration becomes impossible unless the ransom is paid.
2. Maintain golden images and infrastructure as code. Preconfigured system images let you rebuild quickly. For cloud resources, keep version controlled templates, with offline copies.
3. Write and exercise an incident response plan. Include a communications plan, keep a hard copy, and have the CEO or equivalent approve it in writing. Check breach notification laws that apply.
4. Apply zero trust and least privilege. The guide recommends zero trust architecture with granular access control that assumes the network is compromised.
5. Do not expose remote desktop to the internet. If a service must be exposed, apply compensating controls, close unused RDP ports, enforce lockouts, use MFA and log attempts.
6. Scan for vulnerabilities, especially on internet facing devices. CISA offers a no-cost vulnerability scanning service.
7. Patch and update, starting with internet facing servers. Timely patching limits what attackers can use.
8. Require MFA on VPNs and remote access. If MFA is not possible, the guide says to require passwords of 15 or more characters for teleworkers.
9. Train staff and filter email. Run awareness training that includes how to report suspicious activity, flag external emails and filter known malicious indicators at the gateway.
10. Join an information sharing center. The guide's initial steps include joining a sector based ISAC where eligible, such as MS-ISAC for state, local, tribal and territorial entities.
Which of the ten comes first?
Start with the ones that decide whether you survive an attack: backups and the response plan. Prevention reduces the odds, but recovery decides the outcome.
A constructed example: a 90 person manufacturer keeps nightly backups on a network share that is mapped on the file server. An attacker who reaches the server encrypts the share and the backups together. The company moves one weekly copy to offline media and tests a restore. The next incident, if it comes, is an inconvenience instead of an existential event.
What happens after an attack starts?
Part 2 of the guide is a response checklist, with steps for detection and analysis, containment and eradication, and later phases. It also expanded its threat hunting tips in the 2023 update. Read it before an incident, not during one, and walk your team through it in an exercise. Teams that have never seen the checklist lose the first hour deciding who does what.
The prevention list is long, so do not wait to finish it. Ransomware preparation is never complete. What matters is that your backups restore, your plan is current and the person who needs to make the first call knows the number.
How to check or apply this
- Confirm one backup copy is offline or immutable, and restore a sample this month.
- Document how to rebuild your five most important systems from images or code.
- Review the response plan: owners, phone numbers, legal contacts, printed copy.
- List every internet facing service and close remote desktop exposure.
- Turn on MFA for VPN, email and administrator accounts.
- Sign up for CISA's vulnerability scanning if you are eligible.
- Patch internet facing servers on a defined timeline.
- Add an external email banner and a report button.
- Reduce privileged accounts and review them each quarter.
- Join your sector's information sharing group.
Quick check
Are cloud backups safe from ransomware?
Not automatically. The guide recommends cloud backup planning and notes that immutable storage can protect data, with cautions about compliance fit and cost from misconfiguration.
Who should approve the incident response plan?
The guide says the CEO or equivalent should review and approve the plan and the communications plan in writing.
Sources
Last reviewed: 18 October 2026.
