Practical guidance on preparing companies for cyberattacks, ransomware, data loss, system outages and operational crises. We explain incident response planning, ransomware readiness, crisis communication, backups, recovery testing, business continuity management and post-incident evidence.
Ransomware Checklist for Companies
A ransomware checklist helps a company prepare for an attack, reduce the impact of data encryption and return to operations faster. The key elements are backups, MFA, patching, segmentation, monitoring, incident response plan, crisis communication, contact list, recovery testing and clear board decisions before an incident happens.
Prepared by: CCyber Editorial Team
A ransomware checklist for companies should cover three stages: preparation before an attack, response in the first hours and safe recovery. Before an attack, the company needs tested backups, MFA, patching, segmentation, monitoring, contact list and communication plan. After ransomware is detected, the company must quickly isolate infected systems, preserve evidence, activate the crisis team, assess the attack scope, protect backups and recover systems only from clean sources.
July 2026
Ransomware is a type of malware or attack that blocks access to systems or encrypts data and demands payment to unlock it. In many modern attacks, criminals also steal data and threaten publication, contact with customers, media exposure or further business disruption.
Ransomware impact may include:
Ransomware is a business problem, not only a technical one. It affects the board, finance, operations, legal, communications, IT, security, customers and suppliers.
The company must know which systems determine its survival after an attack. Not all systems are equally important. Email, finance, production, CRM, sales systems, ERP, code repositories and management documents require different treatment.
Prepare a list of:
Evidence to prepare: critical system register with recovery priority.
MFA should cover email, VPN, remote access, cloud systems, administrator accounts, financial systems and developer tools. A stolen password without MFA may be enough for an attacker to enter the environment.
Protect first:
Evidence to prepare: report of users and applications covered by MFA and exception list.
Ransomware often starts with compromised remote access, vulnerable VPN, exposed remote desktop or a supplier account. Remote access should be limited to what is necessary.
Check:
Evidence to prepare: remote access, supplier and exception register.
Vulnerabilities in VPNs, firewalls, mail servers, remote access systems and public applications are especially dangerous. These are often the first places attackers check.
Patch priority:
Evidence to prepare: vulnerability report and patch status of critical systems.
Ransomware spreads faster when users and administrators have excessive permissions. The more access a compromised account has, the greater the impact.
Check:
Evidence to prepare: access review report and removed excessive permissions list.
Segmentation limits ransomware spread. If the whole company works in one flat network, attackers can more easily move between computers, servers, backups and production systems.
Separate:
Evidence to prepare: segmentation diagram and list of allowed connections between segments.
Backups are one of the most important controls. They must be regular, tested, separated from the main environment and protected against deletion by attackers.
A good backup strategy includes:
Evidence to prepare: latest recovery test report and critical system backup list.
Ransomware usually does not start with encryption. Before that, there may be phishing, account takeover, network scanning, lateral movement, disabling security tools, data theft and backup deletion.
Monitor:
Evidence to prepare: ransomware alert list and escalation procedure.
The plan should be short, practical and available even when the company cannot access email, network drives or the ticketing system.
The plan should include:
Evidence to prepare: ransomware response plan available offline.
During an attack, normal communication channels may not work. Email, chat, internet telephony or ticketing may be unavailable. The company needs an alternative communication plan.
Prepare:
Evidence to prepare: crisis communication plan and message templates.
Do not start with chaotic calls to everyone. Activate the predefined crisis team. It should include IT, security, board, legal, communications, operations and owners of critical systems.
Goal: one decision structure, one priority list, one version of the truth.
If infected devices are known, disconnect them from wired networks, Wi-Fi and other connections. Do not connect backup media to suspicious devices.
Note: do not blindly shut everything down if this may destroy evidence or make analysis harder. The shutdown decision should be made with the technical incident lead.
Immediately check whether the attacker has access to backup systems. If needed, separate backups from the production environment, block suspicious accounts and preserve backup metadata.
Block accounts used in the attack, accounts with suspicious logins and accounts whose credentials may have been compromised. Priorities are administrators, VPN, email, cloud accounts and supplier accounts.
Check VPN, remote desktop, administrative tools and supplier access. If an active attacker session is suspected, terminate it and preserve logs.
Save the ransom note, screenshots, encrypted file names, wallet addresses, attacker website addresses, logs, affected host list and detection time.
If corporate email is affected or may be monitored by attackers, switch the crisis team to an alternative communication channel.
Answer:
Common entry points are phishing, compromised account, vulnerable VPN, exposed remote desktop, public application vulnerability, supplier or stolen credentials.
If the entry point is not identified, the company may restore systems and the attacker may return through the same path.
Many ransomware attacks include data theft before encryption. Check unusual data transfer, access logs, archives created on servers, outbound connections and communication with unusual locations.
Not everything must be restored at once. First restore the minimum ability for the company to operate.
Example sequence:
Ransomware may trigger incident notification, personal data breach notification, customer notification, insurer notification, regulator notification, CSIRT notification or law enforcement reporting.
Involve legal, data protection, compliance and the board. Do not rely only on IT’s technical assessment.
Communication must be clear, consistent and careful. Do not promise that data was not stolen if analysis is still ongoing. Do not publish technical details that may help attackers.
Prepare communications for:
Do not restore systems from a backup that has not been checked. Ransomware or attacker tools may have entered backups before the company detected the incident.
Before recovery, check:
Recovering business systems does not make sense if the core infrastructure is still compromised.
First rebuild:
Assume that some passwords and secrets may have been compromised. This includes user passwords, administrator passwords, service accounts, API keys, tokens, cloud credentials and supplier credentials.
After recovery, attackers may try to return. Monitoring should be increased for at least several weeks after the incident.
Monitor:
Recovery is not the end. If the company restores the environment with the same passwords, same remote access, no MFA and the same vulnerabilities, the risk of attacker return is high.
The decision to pay a ransom is a board, legal, operational and ethical decision. It should be made after consultation with legal counsel, insurer, incident response specialists and law enforcement where applicable.
Key facts:
The best strategy is to prepare the company so that paying is not the only survival option.
A backup that has not been tested is hope, not a strategy. The company must regularly check whether it can restore data and systems within an acceptable time.
Attackers often try to delete or encrypt backups. Backups should be protected against deletion, offline or immutable.
Without MFA, a stolen password may give an attacker access to critical systems. Administrators and remote access must be protected first.
The plan, contact list and procedures must also be available offline. If they are only on an encrypted network drive, they will not help during a crisis.
Lack of consistent communication may deepen the crisis. Employees, customers, media and regulators should receive clear, approved and current information.
If the company does not know how the attacker entered, it may restore the environment and be attacked again.
The hardest decisions should not be made for the first time at 3 a.m. The board should define principles for communication, payment, recovery priorities and authority contact earlier.
A manufacturing company has 250 employees. It has ERP, file server, cloud email, several production systems and remote access for suppliers. The board assumes backups work because the backup system sends positive daily notifications.
During a ransomware exercise, it turns out that nobody has tested ERP recovery for more than a year, file server backups are accessible from the same domain, a supplier has permanent VPN access without MFA and the response plan exists only on a network drive.
The exercise shows that the biggest problem is not the lack of one tool. The problem is lack of operational readiness.
The company implements MFA for administrators and VPN, separates critical data backups from the main environment, prepares an offline contact list, tests ERP recovery and creates a first 24-hour response plan.
After 90 days, the board sees a concrete change: the company knows what to recover first, how long it takes, who makes decisions, how to communicate with customers and which gaps still need to be closed.
ccyber.io helps companies prepare for ransomware practically, without excessive theory and without assuming that one tool solves the problem. We focus on operational readiness, backups, response plan, communication, board decisions and recovery testing.
We can support your organization with:
The best first step is a short ransomware readiness assessment. It helps check whether the company has working backups, a recovery plan, access control, prepared communication and board decisions for a real attack.
Ransomware is an attack where criminals block access to systems or encrypt data and demand payment. In many cases, they also steal data and threaten to publish it.
The most important protections are tested backups, MFA, patching, remote access restriction, segmentation, monitoring and an exercised response plan.
Not always. Backups must be offline or protected against deletion, regularly tested and checked before recovery. The company must also close the attacker’s entry point.
Activate the crisis team, isolate infected devices, protect backups, block suspicious accounts, preserve evidence and determine the scope of the attack.
There is no guarantee of data recovery after payment. The decision requires legal, operational and board-level analysis. The best strategy is to prepare the company so that payment is not the only option.
It depends on sector, country, data type and incident impact. Notification may be required to a regulator, CSIRT, data protection authority, insurer, customers or law enforcement.
At least once a year, and more often in higher-risk companies. Both the technical side and board decisions, communication and system recovery should be exercised.
The board should receive information about critical systems, backup status, recovery test results, MFA level, remote access, major gaps and the budget needed to reduce risk.
A ransomware checklist for companies should not be only a document in a security folder. It should be a practical tool that helps prepare the company, make quick decisions and return to operation after an attack.
The key elements are ransomware-resistant backups, MFA, patching, segmentation, monitoring, remote access restriction, response plan, crisis communication and regular exercises.
Companies that prepare these elements earlier do not eliminate risk completely, but significantly improve their chances of limiting losses, recovering faster and managing the crisis more calmly.
What to Do in the First 24 Hours After a Cyberattack?
The first 24 hours after a cyberattack determine the scale of loss, downtime and the quality of later investigation. The most important actions are rapid containment, crisis team activation, evidence preservation, impact assessment, board communication and decisions on reporting, backups and recovery.
Prepared by: CCyber Editorial Team
In the first 24 hours after a cyberattack, a company should focus on limiting the spread of the incident, preserving evidence, activating the crisis team, assessing the impact on systems, data and customers, and making decisions about reporting, communication and recovery. The biggest mistake is chaotic deletion of evidence, restarting systems without a plan, hiding the incident or restoring backups before confirming that the environment is clean.
July 2026
The first 24 hours are the period from detecting suspicious activity to the point where the company has initially controlled the incident, knows the most important facts and can make decisions about next steps.
During this period, the organization should establish:
The first day is not always enough for a full technical investigation. It should be enough to organize action, limit damage and avoid decisions that make the situation worse.
During a crisis, the natural reaction is to “fix everything as quickly as possible”. During a cyberattack, this can be dangerous. Chaotic actions can destroy logs, remove traces, make analysis harder, overwrite evidence or restore systems in a way that allows attackers to regain access.
In the first hours, the three key goals are:
Only after that comes full system recovery, configuration fixes, return to normal operations and longer-term remediation.
The first minutes determine whether the company starts acting according to a plan or falls into confusion. Someone must take coordination responsibility and record the basic facts.
What to do:
Examples of first symptoms:
Evidence to prepare: a short record of the first report, detection time, reporting person and first symptoms.
If there is a risk that the attack is still ongoing, its spread must be limited. Isolation does not always mean shutting down everything. The decision depends on the incident type and business impact.
Possible actions:
Avoid doing the following without consultation:
Evidence to prepare: list of systems and accounts isolated in the first hour and the reason for isolation.
A cyberattack should not be handled only by IT. In the first hours, technical, legal, business and communication perspectives must be combined.
Minimum crisis team:
During the first meeting, decide:
Evidence to prepare: crisis team list, roles, decisions and agreed communication channel.
Not every cyberattack looks the same. Ransomware, email compromise, data leakage and payment fraud require different actions. The incident type must be determined quickly.
Common incident types:
Questions for initial classification:
Evidence to prepare: initial incident classification, affected systems, impact scale and list of unknowns.
Good evidence is needed for technical analysis, reporting, discussions with insurers, regulators, customers and possibly law enforcement. If evidence is destroyed, the company may not determine what happened.
Preserve in particular:
Also document the team’s actions:
Evidence to prepare: incident action log and preserved logs and artifacts.
After a cyberattack, many companies want to restore systems immediately. This is understandable, but risky. If the attacker still has access or backup contains malware, the company may restore the problem instead of solving it.
Check:
Recovery priorities should be business-driven. First restore systems necessary for company operations, customer service, human safety, production, sales, logistics or finance.
Evidence to prepare: backup status, list of systems to restore, priorities and decision on safe recovery conditions.
A cyberattack may trigger reporting obligations. Not every situation requires reporting to a regulator, but the decision should be conscious and documented.
Check whether the incident may need to be reported to:
If personal data is involved, the data protection officer or privacy owner should immediately assess whether a personal data breach occurred and whether notification is required. If the company is covered by NIS2, KSC, DORA or sectoral rules, check the relevant deadlines and reporting format.
Evidence to prepare: reporting obligation assessment note, responsible persons, deadlines and decisions.
After the first several hours, the company should have an initial picture of the situation. This is the moment to organize communication and the plan for the next days.
Prepare communication for:
Communication should be short, factual and based on confirmed information. Do not speculate. Do not promise that “everything is under control” if the company does not yet have complete information.
The plan for the next days should include:
Evidence to prepare: end-of-day status, communications, board decisions and 72-hour action plan.
Deleting files, formatting systems, cleaning logs or chaotic reinstallation can make it difficult to determine how the attack happened and whether data was stolen.
Restoring a system without removing the cause may lead to another compromise or encryption. First, assess whether the environment is clean and whether attacker access has been cut off.
Contact with the attacker, negotiations or ransom decisions require involvement of the board, legal, experts and often the insurer. Rushed actions may increase legal, financial and operational risk.
If an employee clicked a phishing link and reported it quickly, the company has a better chance to limit damage. A culture of hiding mistakes increases response time.
One compromised account can lead to lateral movement, data leakage, fake invoices or access to customer systems. Every incident should be classified based on facts, not intuition.
The board does not need a detailed technical dump. It needs clear information about business impact, risks and decisions.
A manufacturing company notices in the morning that some files on a server are encrypted. An employee sends a screenshot to IT. IT sees a ransomware note and unusual activity on one administrator account.
In the first hour, the company disconnects the affected server from the network, disables the suspicious account, activates the crisis team and switches to an emergency communication channel. It does not format the server, delete the note or immediately restore backup.
In the following hours, the company preserves logs, checks whether the attack spread to other systems, assesses backups and determines which production processes are stopped. The board receives a status update: which systems are affected, what has been done, what risks remain and what decisions are needed.
After 24 hours, the company knows it has a clean backup from two days earlier, but still needs to confirm whether data was exfiltrated. It does not return to normal operations immediately. First, it builds a safe recovery environment, changes passwords, checks privileged accounts and prepares customer communication.
ccyber.io helps companies prepare for cyberattacks, organize incident response and reduce chaos in the first hours after an attack.
We can support your organization with:
The best first step is to prepare a simple first 24 hours plan. This helps the company know who makes decisions, how to isolate the threat, where to collect evidence, when to inform the board and how to avoid actions that make the situation worse.
Not always. Sometimes selected systems or network segments must be disconnected quickly, but shutting everything down can stop the business and make analysis harder. The decision should depend on the incident scale, attack type and business impact.
Not always. First, check whether backup is available, clean and whether the recovery environment will not be compromised again. Restoring backup without analysis may restore the problem.
A ransom decision is difficult and requires involvement of the board, legal, experts and often the insurer and law enforcement. Payment does not guarantee data recovery and may increase the risk of future attacks.
It depends on the impact on services, data, contracts and regulations. If the incident affects customers, personal data, service deadlines or contractual obligations, communication should be prepared quickly, but based on confirmed facts.
It depends on the type of organization, sector, incident scale and legal obligations. Companies covered by NIS2, KSC or sector-specific regulations should check reporting obligations particularly quickly.
The incident should be reported immediately. Preserve the message, change the password, revoke sessions, check email rules and assess whether the account was used for further actions. The mistake should not be hidden.
There should be one incident coordinator, but decisions require cooperation between IT, security, the board, legal, communications, business process owners and the data protection officer if personal data may be involved.
The company should prepare an incident response plan, crisis contact list, communication procedure, backup test, tabletop exercise, critical system list and a basic cybersecurity evidence pack.
The first 24 hours after a cyberattack determine whether the company limits damage or increases chaos. The most important actions are threat isolation, evidence preservation, crisis team activation, impact assessment, backup review and conscious communication and regulatory decisions.
The goal is not to solve every problem during the first day. The goal is to stop the situation from getting worse, keep control and prepare safe recovery.
Organizations that have a plan, roles, contacts, backups and tested scenarios respond faster, make fewer mistakes and protect business continuity more effectively.
We write about regulations such as NIS2, DORA, CRA and ISO 27001, cybersecurity for SMEs and critical infrastructure, as well as cyber hygiene, emerging threats and building security awareness within organisations.
Every article delivers practical knowledge - no jargon, just concrete steps you can act on to effectively protect your data, people and business continuity.