Ransomware Readiness Checklist: 12 Controls That Actually Matter in 2026

Ransomware groups keep changing their names, their leak sites and their negotiation tactics. How they get in has changed far less. In the incidents our security operations team responds to, the same handful of weaknesses show up again and again: exposed remote access, stolen credentials, unpatched edge devices and backups that were never tested.

This checklist puts the controls that break those attack paths in priority order. You don't need a huge budget to work through it, but you do need to be honest about where you stand today.

Stop the initial access

1. Remove remote access that faces the internet

Remote desktop, VPN portals and management interfaces exposed to the internet are still the most common way in. Inventory every externally reachable service and put anything administrative behind a zero-trust access layer or a VPN protected by multi-factor authentication. Attack surface monitoring will tell you when something new appears.

2. Enforce phishing-resistant MFA

Push notifications and SMS codes can be phished or bombarded until a user taps approve. For administrators, remote access and email, use FIDO2 security keys or passkeys. Then turn off legacy authentication protocols that skip MFA altogether.

3. Patch edge devices within days, not months

Firewalls, VPN concentrators and file-transfer appliances are favorite targets because they sit on the perimeter and rarely run endpoint protection. Treat critical vulnerabilities in these devices as emergencies with a 72-hour patch target.

4. Monitor for leaked credentials

Infostealer malware on personal devices regularly leaks corporate passwords and session cookies. Watch for your domains in credential dumps and reset affected accounts before the credentials are sold.

Limit how far an attacker can move

5. Separate admin accounts from everyday accounts

Domain administrators should never read email or browse the web with their privileged accounts. Use separate, tightly monitored admin identities, and give privileged access only for as long as a task needs it.

6. Segment the network

Flat networks let a single compromised laptop reach every server. Segment by function, block workstation-to-workstation SMB, and restrict which hosts can reach your domain controllers and backup infrastructure.

7. Deploy EDR everywhere, and watch it

Endpoint detection and response only helps if someone acts on its alerts at 3 a.m. on a Sunday, which is when many attacks begin. Either staff a 24/7 function or use a managed detection and response service.

8. Tighten your third-party access

IT providers and software vendors often hold persistent remote access into your environment. Review every vendor connection, require MFA, and make sure you'd know if one of them was compromised.

Make recovery certain

9. Keep immutable, offline backups

Attackers look for backups first. Keep at least one copy immutable or offline, protected with separate credentials that are not joined to your main identity provider.

10. Test restores regularly

A backup you have never restored is only a hope. Run quarterly restore tests of critical systems and time them, so you know your real recovery time before an incident tells you.

11. Write and rehearse the response plan

Decide ahead of time who calls legal, who talks to customers, who can authorize taking systems offline and how you'll communicate if email is down. Run a tabletop exercise at least twice a year.

12. Know your obligations

Regulators, insurers and contracts may require notification within strict deadlines. Map those obligations now so that the clock doesn't surprise you mid-incident.

Where to start

If you can only do three things this quarter, start with exposed remote access, phishing-resistant MFA for admins and a tested offline backup. Together they block the most common initial access paths and make sure you can recover if something still gets through.