Ransomware is the biggest single cyber threat facing UK businesses right now. The average cost of recovery is over £100,000, and for SMEs without proper preparation, a single attack can be fatal.
This isn't a scare piece. It's a practical checklist you can work through to assess where your business stands - and what to fix first. If you want expert help, our ransomware readiness service covers all of this and more.
The 12-Point Ransomware Readiness Checklist
1. ✅ Immutable Backups in Place
The question: Can your backups be encrypted or deleted by ransomware?
If your backups are on the same network as your main systems, or if they can be modified by any account, they're at risk. Immutable backups - copies that can't be altered or deleted - are your last line of defence.
Our backup and disaster recovery service implements immutable, off-site backups with regular restore testing.
2. ✅ Backups Tested Recently
The question: When did you last restore from backup?
A backup you've never tested is a backup you can't trust. We test restores quarterly for all managed clients. If you can't remember the last time yours were tested, that's a red flag.
3. ✅ Multi-Factor Authentication (MFA) Everywhere
The question: Can any of your systems be accessed with just a password?
MFA stops the vast majority of account compromise attacks. It should be enabled on email, VPN, remote desktop, cloud services, and admin accounts - no exceptions.
This is a core requirement for Cyber Essentials Plus certification.
4. ✅ Endpoint Detection & Response (EDR) Deployed
The question: Are you still relying on traditional antivirus?
Traditional antivirus catches roughly 60% of modern threats. EDR/XDR solutions use AI-driven behavioural analysis to catch what signature-based tools miss - including ransomware.
5. ✅ Email Security Beyond the Basics
The question: Do you have advanced anti-phishing protection?
Phishing is the number one delivery method for ransomware. Basic spam filtering isn't enough. You need advanced threat protection that catches impersonation attacks, malicious attachments, and weaponised links.
This sits within our broader cyber security services.
6. ✅ Security Awareness Training
The question: Would your team recognise a phishing email?
Technology catches most threats, but some will always get through. Regular training and simulated phishing campaigns give your team the skills to spot what the filters miss.
7. ✅ Network Segmentation
The question: If one device is compromised, can ransomware spread to everything?
Flat networks where every device can talk to every other device make ransomware's job easy. Segmenting your network limits the blast radius of an attack.
8. ✅ Patch Management Current
The question: Are your systems and software up to date?
Unpatched vulnerabilities are a common entry point for ransomware. Automated patch management ensures critical updates are applied promptly without relying on users to click "update later" indefinitely.
9. ✅ Admin Accounts Locked Down
The question: How many people have admin access?
Every admin account is a high-value target. The principle of least privilege means people only have the access they need for their job - nothing more. Admin accounts should have separate credentials and MFA.
10. ✅ Incident Response Plan Documented
The question: Does everyone know what to do in the first hour of an attack?
A documented, tested incident response plan means the difference between containment in hours and chaos for weeks. It should cover: who to call, what to disconnect, how to preserve evidence, and how to communicate with staff and customers.
11. ✅ Remote Access Secured
The question: Is RDP exposed to the internet?
Remote Desktop Protocol (RDP) exposed directly to the internet is one of the most exploited attack vectors. If your team works remotely, they should connect through a VPN or zero-trust access solution - not open RDP ports.
For more on securing remote teams, read our guide: 5 Critical Security Measures Every Remote Team Needs.
12. ✅ Cyber Insurance Reviewed
The question: Does your policy actually cover ransomware?
Many cyber insurance policies have exclusions around ransomware, especially if you can't demonstrate basic security controls. Review your policy annually, and make sure you meet the requirements for a valid claim.
Achieving Cyber Essentials Plus certification is increasingly a prerequisite for cyber insurance coverage.
How Did You Score?
- 10-12 ticks: You're in good shape. Keep testing and reviewing.
- 7-9 ticks: You have gaps that need addressing. Prioritise backups, MFA, and EDR.
- Under 7: You're at significant risk. Get a professional assessment before something goes wrong.
What To Do Next
If this checklist revealed gaps, don't panic - but do act. The most impactful steps for most businesses are:
- Implement immutable backups and test them
- Deploy endpoint protection to replace basic antivirus
- Enable MFA on everything
At LeapIT, our ransomware readiness assessment covers all 12 points and gives you a prioritised action plan tailored to your business.
We work with businesses across Birmingham, Solihull, and the wider West Midlands - from legal firms handling sensitive case data to manufacturers running production-critical systems.
Book a free ransomware readiness assessment and find out where your gaps are - before attackers do.
