A Ransomware Readiness Guide for Mid-Sized Organisations

Ransomware readiness isn't primarily about preventing every possible initial compromise. That's not realistic for any organisation. It's about making sure that when it happens, the damage is contained and recovery is actually possible.

Backup isolation: the single highest-leverage control

Backups that are reachable from the same credentials or network as production are not a ransomware safety net. They're an extension of the blast radius. An attacker who's established domain-level access will look for and destroy backups they can reach before deploying ransomware, specifically to remove the option of recovering without paying.

• Are backups isolated: offline, immutable, or on entirely separate credentials from production?
• Have you actually tested a restore recently, not just confirmed the backup job completed?
• Is backup retention long enough to recover from an attack that went undetected for weeks?

Containment planning, decided in advance

The decisions that matter most in the first hours of a ransomware incident (whether to isolate network segments, whether to shut down affected systems, who has authority to make that call) should be decided before an incident, not during one. Under pressure, teams without a plan default to either doing nothing (while it spreads) or an overcorrection (shutting down systems that didn't need it, complicating recovery).

The communication plan you don't want to write during an incident

Who gets notified, in what order, and what gets said to customers, regulators, and staff: deciding this during an active incident wastes time and produces worse decisions than deciding it in advance. If you're subject to NIS2 or GDPR breach notification requirements, the timelines are tight enough that improvising isn't a realistic option.

A short self-check

• Could an attacker who compromises a standard user account eventually reach and destroy your backups?
• Does anyone on your team know, right now, who has authority to isolate a network segment during an incident?
• Has your incident response plan, if one exists, actually been tested with a tabletop exercise?

If any of those answers are "no" or "not sure," that's exactly the gap worth closing before it's tested for real.