Ransomware readiness checklist: the controls that matter most

Order the list by what actually breaks in

Most readiness checklists are ordered by intuition, intuition says phishing, and for three years the evidence said otherwise. It has now flipped back. In Sophos’s The State of Ransomware 2026 — an independent survey of 2,158 IT and cybersecurity leaders across 17 countries whose organisations were hit by ransomware in the previous year — malicious email (26%) and phishing (24%) are the top two technical root causes, together accounting for half of all incidents. Exploited vulnerabilities, which led the ranking in each of the three previous editions, fell 14 percentage points to 18%. Compromised credentials held third place at 23%.

Verizon’s 2026 Data Breach Investigations Report pulls the other way, and the difference is one of population rather than a contradiction. Across breaches of every kind — not only ransomware — exploitation of vulnerabilities is now the leading initial access vector, at 31%, up from 20% the year before, while credential abuse, the previous leader, has fallen to 13% as a first action. ENISA’s Threat Landscape 2025, drawn from 4,875 incidents between 1 July 2024 and 30 June 2025, describes campaigns "rapidly weaponising [vulnerabilities] within days of their disclosure". Sophos surveys ransomware victims; the DBIR analyses breaches. Read together, the two doors are much the same size and neither can wait for next quarter.

So email defence and patching the exposed estate share the top of this list, and MFA sits alongside them rather than beneath them. One Sophos finding settles that last point: among organisations whose ransomware attack started with compromised credentials, 97% already had MFA deployed in some capacity. MFA is measured by coverage, not by presence. Size shifts the picture too — a lack of people or capacity was cited most heavily by organisations in the 100–250 employee band — so read your own row first.

The controls, ranked by what the evidence buys you

Priority 1 — backups you can actually restore

• Keep at least one backup copy offline or immutable, isolated from day-to-day credentials.
• Follow a 3-2-1 approach: three copies, two media types, one off-site or offline.
• Test restores regularly, against a stated recovery time — an untested backup is a hope, not a plan.
• Protect backup systems with separate, strong authentication and their own access controls.
• Maintain and regularly update "golden images" of critical systems, and keep infrastructure-as-code templates and required executables with the offline copies.

Priority 2 — close the exposed front doors

• Harden the mail path: advanced filtering, DMARC, DKIM and SPF, and regular phishing awareness training. Malicious email and phishing are now half of all ransomware root causes.
• Enforce multi-factor authentication on email, VPN, remote access and every administrative account — then audit the coverage, because almost every credential-root-cause victim already had MFA somewhere.
• Patch internet-facing systems fast, and treat VPN concentrators, firewalls and other edge devices as the first tier, not the last.
• Remove or tightly restrict exposed RDP.
• Kill password reuse, and monitor for your own domains and mailboxes appearing in credential dumps.

The credential-monitoring item is easy to dismiss as a vanity feed until you look at what precedes a named victim. Verizon matched ransomware victims from the two previous years against credential-leak data: 73% had an infostealer or other credential leak in the year before they were publicised, and half of those saw it within 95 days of the attack. Infostealer output is not a separate problem from ransomware; for many victims it is the same problem, observed earlier.

Priority 3 — contain and detect

• Segment the network so one compromised machine isn’t a path to everything.
• Apply least privilege and tiered administration, especially between the production estate and the backup estate.
• Deploy EDR with monitoring, so intrusions are caught before deployment day.
• Log centrally, and alert on the signals CISA names: misuse of vssadmin.exe, wbadmin.exe, bcdedit.exe, fsutil.exe and wmic.exe to inhibit recovery; newly created domain accounts or unexplained privilege escalation; anomalous VPN logins; unexpected RMM software.
• Alert on large or unusual outbound transfers — CISA names Rclone, Chisel tunnelling SSH over HTTPS 443, abuse of Cloudflared tunnels, and web file-storage services as exfiltration routes.

Priority 4 — a plan you have actually rehearsed

• Write an incident-response plan with named roles and clear decision-makers.
• Include legal, communications and regulatory reporting, with the clocks written down rather than looked up on the day.
• Run a tabletop exercise at least annually, with the people who would really be in the room.
• Keep offline and hard copies of the plan and the key contact list — you may lose access to the systems that hold them.

What belongs in that plan, in what order, and what the first 72 hours look like is covered in building a ransomware recovery plan that works under pressure.

The root causes that never make it onto a checklist

Sophos also asks victims what operational factors let the attack succeed; respondents cited 2.5 factors on average, down from 2.7. Grouped, 62% cited a security gap, known or unknown — the most-cited category for the second year running — followed by 58% citing a lack of people or skills and 57% a lack of, or poor-quality, protection. Human error, at 35%, was the only individual factor that rose year on year.

The second one deserves a moment. "Security gaps we were not aware of" is not a control you can buy; it is the argument for testing, stated by the people it happened to. A control inventory tells you what you meant to deploy. Only an assessment tells you what an attacker finds — the forgotten subsidiary’s firewall, the backup share reachable from a workstation.

What NIS2 turns from folklore into a requirement

If you are in scope for the NIS2 Directive (EU) 2022/2555, most of this checklist stops being good practice and becomes a documented obligation. Article 21(2)(b) covers incident handling; Article 21(2)(c) covers business continuity, "such as backup management and disaster recovery, and crisis management"; Article 21(2)(f) requires policies and procedures to assess the effectiveness of the measures; and Article 21(2)(g) covers basic cyber hygiene and training. Article 20(1) and (2) put approval and oversight on the management body and make it liable.

Commission Implementing Regulation (EU) 2024/2690 gives "3-2-1" real shape. It binds the listed digital entity types and is the best benchmark for everyone else. Annex 4.2 requires backup plans to include recovery times; assurance that copies are complete and accurate, including configuration data and data in cloud environments; storage of copies "in a safe location or locations, which are not in the same network as the system, and are at sufficient distance to escape any damage from a disaster at the main site"; access controls in line with the asset classification; and a procedure for restoring. Annex 6.5 adds security testing: a documented methodology, documented scope and results, a criticality assessment per finding, and mitigating actions for the critical ones.

Prove it works

Controls on paper are not controls that hold. A penetration test or ransomware-readiness assessment answers what the checklist cannot: whether an attacker could get in, move laterally and reach the backups — and it produces the documented findings, criticality assessments and mitigating actions Article 21(2)(f) and Annex 6.5 expect.