An executive-focused ransomware readiness checklist covering identity, backups, attack paths, detection, response roles and recovery validation.
Protect the identities attackers want
Administrative accounts, remote-access identities and service credentials are frequent targets during ransomware operations. Review privileged access, multifactor coverage, dormant accounts, credential reuse and pathways that allow a normal user to become an administrator.
Know the paths to critical systems
Map how an attacker could move from an internet-facing service or compromised endpoint toward identity infrastructure, virtualization platforms, backups and high-value data. Attack-path exercises help teams prioritize controls that reduce the ability to escalate and move laterally.
Validate backup isolation and recovery
A backup is only useful if it remains available during an attack and the business can restore the systems it actually depends on. Test recovery procedures, credentials, backup administration boundaries and realistic recovery times rather than relying only on successful backup jobs.
Define incident authority before the incident
Security, IT, legal, leadership and communications teams should know who can make containment decisions, isolate systems, engage external specialists and communicate with stakeholders. Clear authority reduces delay during high-pressure situations.
Practice with realistic scenarios
Tabletop exercises should include incomplete information, conflicting business priorities and operational consequences. The objective is not to predict one exact attack, but to improve decision-making, evidence preservation, escalation and recovery coordination.
What to do next
Use these principles as a starting point, then validate them against your own architecture, users, business workflows and threat exposure. Security priorities become more useful when they are tied to the systems and outcomes the business actually depends on.