Ransomware Readiness Checklist for 2026

Ransomware is no longer only about encrypted files. Many groups now steal data first and threaten to publish it, which means backups alone will not solve the whole problem. Good preparation reduces both the chance of an attack and the damage if one succeeds.

Use this checklist to find your gaps. You do not need to finish everything this month, but you should know where you stand on each item.

Close the common entry points

Most ransomware incidents start with something familiar: a phished password, an exposed remote service or an unpatched system facing the internet.

• Require MFA for email, VPN, admin accounts and remote access
• Remove or restrict internet-facing remote desktop services
• Patch internet-facing systems first, and do it quickly
• Filter email and teach staff how to report suspicious messages

Limit how far an attacker can move

Once inside, attackers look for admin credentials and for ways to spread. Your job is to make every step harder and noisier.

• Separate admin accounts from everyday accounts
• Segment critical systems and backups from the wider network
• Deploy endpoint detection on servers as well as laptops
• Make sure someone is watching alerts at night and at weekends

Make recovery possible

Backups are often an attacker’s first target, so they need protection of their own. Keep at least one copy offline or immutable, and store its credentials away from your main identity system.

A backup you have never restored is only a theory.

Test real restores on a schedule, and time them. Knowing that a core system takes three days to rebuild is valuable information to have before an incident rather than during one.

Rehearse the first 24 hours

Under pressure, people forget plans they have only read. Run a tabletop exercise at least once a year with technical staff, leadership, legal and communications all in the room.

• Who can decide to take systems offline?
• How will you communicate if email is down?
• Who contacts your insurer, counsel and regulators?
• Where is the plan kept if your file shares are encrypted?

Know your data

Finally, work out what sensitive data you hold, where it lives and who can reach it. If data is stolen, this is what determines your legal and customer obligations. Removing data you no longer need is one of the simplest risk reductions available.