Ransomware readiness checklist: the controls that matter most

Order the list by what actually breaks in

Most readiness checklists are ordered by intuition, intuition says phishing, and for three years the evidence said otherwise. It has now flipped back. In Sophos’s The State of Ransomware 2026 – an independent survey of 2,158 IT and cybersecurity leaders across 17 countries whose organisations were hit by ransomware in the previous year – malicious email (26%) and phishing (24%) are the top two technical root causes, together accounting for half of all incidents. Exploited vulnerabilities, which led the ranking in each of the three previous editions, fell 14 percentage points to 18%. Compromised credentials held third place at 23%.

Verizon’s 2026 Data Breach Investigations Report pulls the other way, and the difference is one of population rather than a contradiction. Across breaches of every kind – not only ransomware – exploitation of vulnerabilities is now the leading initial access vector, at 31%, up from 20% the year before, while credential abuse, the previous leader, has fallen to 13% as a first action. ENISA’s Threat Landscape 2025, drawn from 4,875 incidents between 1 July 2024 and 30 June 2025, describes campaigns “rapidly weaponising [vulnerabilities] within days of their disclosure”. Sophos surveys ransomware victims; the DBIR analyses breaches. Read together, the two doors are much the same size and neither can wait for next quarter.

So email defence and patching the exposed estate share the top of this list, and MFA sits alongside them rather than beneath them. One Sophos finding settles that last point: among organisations whose ransomware attack started with compromised credentials, 97% already had MFA deployed in some capacity. MFA is measured by coverage, not by presence. Size shifts the picture too – a lack of people or capacity was cited most heavily by organisations in the 100–250 employee band – so read your own row first.

The controls, ranked by what the evidence buys you

Ransomware controls and supporting evidence

Priority	Control	What the evidence says
1	Offline or immutable backups, restore-tested	CISA: “many ransomware variants attempt to find and subsequently delete or encrypt accessible backups”. 94% of surveyed victims reported attempted backup compromise in Sophos’s 2024 study. In the survey, 66% of organisations whose data was encrypted recovered it from backups, up from 54% (Sophos 2026).
2	Email filtering, authentication and phishing training	Malicious email (26%) and phishing (24%) are now the top two root causes, half of all incidents. Sophos’s own recommendation: advanced filtering, DMARC/DKIM/SPF, and regular awareness training (Sophos 2026).
3	Patching internet-facing and edge systems	Exploited vulnerabilities fell to 18% of ransomware root causes (Sophos 2026) but rose to 31% of initial access across all breaches (DBIR 2026). Only 26% of CISA KEV vulnerabilities were fully remediated, at a median of 43 days (DBIR 2026).
4	MFA on email, VPN, remote access and admin – everywhere	Compromised credentials caused 23% of incidents and 79% of attacks began with an identity-based approach, yet 97% of credential-root-cause victims already had MFA somewhere (Sophos 2026).
5	Credential exposure monitoring	73% of ransomware victims had an infostealer or credential leak in the year before they were named, and half of those saw it within 95 days of the attack (DBIR 2026).
6	Segmentation and least privilege	CISA’s response checklist assumes you can isolate impacted systems and restore critical services “on a clean network”. Both depend on segmentation that already exists on the day.
7	EDR and central logging	CISA’s hunt list – shadow-copy deletion via vssadmin.exe, wbadmin.exe and bcdedit.exe, newly created AD accounts, anomalous VPN logins, Rclone or Chisel traffic – is only actionable if something recorded it.
8	Rehearsed incident plan, offline copy	CISA [CPG 2.S]: “Create, maintain, and regularly exercise a basic cyber incident response plan (IRP) … Ensure a hard copy of the plan and an offline version is available.”

Priority 1 – backups you can actually restore

• Keep at least one backup copy offline or immutable, isolated from day-to-day credentials.
• Follow a 3-2-1 approach: three copies, two media types, one off-site, with separate offline or properly configured immutable protection.
• Test restores regularly, against a stated recovery time – an untested backup is a hope, not a plan.
• Protect backup systems with separate, strong authentication and their own access controls.
• Maintain and regularly update “golden images” of critical systems, and keep infrastructure-as-code templates and required executables with the offline copies.

Priority 2 – close the exposed front doors

• Harden the mail path: advanced filtering, DMARC, DKIM and SPF, and regular phishing awareness training. Malicious email and phishing are now half of all ransomware root causes.
• Enforce multi-factor authentication on email, VPN, remote access and every administrative account – then audit the coverage, because almost every credential-root-cause victim already had MFA somewhere.
• Patch internet-facing systems fast, and treat VPN concentrators, firewalls and other edge devices as the first tier, not the last.
• Remove or tightly restrict exposed RDP.
• Kill password reuse, and monitor for your own domains and mailboxes appearing in credential dumps.

The credential-monitoring item is easy to dismiss as a vanity feed until you look at what precedes a named victim. Verizon matched ransomware victims from the two previous years against credential-leak data: 73% had an infostealer or other credential leak in the year before they were publicised, and half of those saw it within 95 days of the attack. Infostealer output is not a separate problem from ransomware; for many victims it is the same problem, observed earlier.

Priority 3 – contain and detect

• Segment the network so one compromised machine isn’t a path to everything.
• Apply least privilege and tiered administration, especially between the production estate and the backup estate.
• Deploy EDR with monitored alerts to help detect intrusions before ransomware deployment.
• Log centrally, and alert on the signals CISA names: misuse of vssadmin.exe, wbadmin.exe, bcdedit.exe, fsutil.exe and wmic.exe to inhibit recovery; newly created domain accounts or unexplained privilege escalation; anomalous VPN logins; unexpected RMM software.
• Alert on large or unusual outbound transfers – CISA names Rclone, Chisel tunnelling SSH over HTTPS 443, abuse of Cloudflared tunnels, and web file-storage services as exfiltration routes.

Priority 4 – a plan you have actually rehearsed

• Write an incident-response plan with named roles and clear decision-makers.
• Include legal, communications and regulatory reporting, with the clocks written down rather than looked up on the day.
• Run a tabletop exercise at least annually, with the people who would really be in the room.
• Keep offline and hard copies of the plan and the key contact list – you may lose access to the systems that hold them.

What belongs in that plan, in what order, and what the first 72 hours look like is covered in building a ransomware recovery plan that works under pressure.

The root causes that never make it onto a checklist

Sophos also asks victims what operational factors let the attack succeed; respondents cited 2.5 factors on average, down from 2.7. Grouped, 62% cited a security gap, known or unknown – the most-cited category for the second year running – followed by 58% citing a lack of people or skills and 57% a lack of, or poor-quality, protection. Human error, at 35%, was the only individual factor that rose year on year.

The second one deserves a moment. “Security gaps we were not aware of” is not a control you can buy; it is the argument for testing, stated by the people it happened to. A control inventory tells you what you meant to deploy. An assessment can help validate gaps in the agreed scope – the forgotten subsidiary’s firewall, the backup share reachable from a workstation.

What NIS2 turns from folklore into a requirement

If you are in scope for the NIS2 Directive (EU) 2022/2555, most of this checklist stops being good practice and becomes a documented obligation. Article 21(2)(b) covers incident handling; Article 21(2)(c) covers business continuity, “such as backup management and disaster recovery, and crisis management”; Article 21(2)(f) requires policies and procedures to assess the effectiveness of the measures; and Article 21(2)(g) covers basic cyber hygiene and training. Article 20(1) assigns approval and oversight to the management body and provides that it can be held liable for infringements; Article 20(2) requires management-body training.

Commission Implementing Regulation (EU) 2024/2690 sets detailed backup requirements, without prescribing the exact “3-2-1” formula. It binds the listed digital entity types. Other organisations should map their applicable law and risks before using it as a reference. Annex 4.2 requires backup plans to include recovery times; assurance that copies are complete and accurate, including configuration data and data in cloud environments; storage of copies “in a safe location or locations, which are not in the same network as the system, and are at sufficient distance to escape any damage from a disaster at the main site”; access controls in line with the asset classification; and a procedure for restoring. Annex 6.5 adds security testing: a documented methodology, documented scope and results, a criticality assessment per finding, and mitigating actions for the critical ones.

Prove it works

Controls on paper are not controls that hold. A penetration test or ransomware-readiness assessment answers what the checklist cannot: whether an attacker could get in, move laterally and reach the backups – and can produce findings, criticality assessments and remediation evidence. Security testing under Annex 6.5 contributes to the broader effectiveness assessment in Annex 7 for entities covered by Regulation (EU) 2024/2690.