Ransomware Preparedness: 10 Actions Before Attack

What Boards Must Do Now to Survive the Inevitable Attack

CyberCQR Top 10 | January 2026 | 5 minutes reading time

The Uncomfortable Reality

The question is not "if" you'll face ransomware, but "when." In 2025, 72% of organisations experienced at least one ransomware attack. Average ransom demand: $8.2M. Average total cost including downtime and recovery: $4.5M.

Organisations that implement these 10 actions before attack reduce total incident costs by 60-80% and recover 10x faster. More importantly: prepared boards make better decisions under pressure.

1. Establish Board-Level Ransomware Decision Framework NOW

Why this matters: During an attack, you'll have 24-72 hours to decide whether to pay ransom. This decision has legal, ethical, and practical implications. You cannot make it well under crisis pressure without pre-approved frameworks.

What to do:

• Board approves decision framework BEFORE incident (criteria for payment vs non-payment)
• Consider: backup status, business impact, regulatory requirements, reputational risk
• Pre-authorise decision-making authority (who can approve payment? CEO alone? CEO + Chair? Full board?)
• Legal counsel reviews sanctions implications (paying sanctioned entities is federal crime)
• Document framework in board minutes—this is fiduciary duty

2. Implement Immutable Backups with Offline Copies

Why this matters: Ransomware operators specifically target and destroy backups before encrypting production systems. If they succeed, you have no recovery option except paying ransom.

What to do:

• 3-2-1-1-0 Rule: 3 copies of data, 2 different media types, 1 offsite, 1 immutable (cannot be deleted/encrypted), 0 errors in restores
• Immutable backups use write-once-read-many (WORM) technology or object lock
• Offline backups physically disconnected from network (air-gapped)
• Test restores monthly—untested backups are not backups
• Board should see metrics: backup coverage %, last restore test date, RTO/RPO

3. Verify Adequate Cyber Insurance with Ransomware Coverage

Why this matters: Cyber insurance can cover ransom payments, forensics, legal fees, business interruption, and regulatory fines. But many policies have exclusions, gaps, or requirements that void coverage if not met.

What to do:

• Board reviews actual policy—not broker summary (exclusions matter)
• Verify coverage includes: ransom payment, forensics, legal, notification, business interruption, extortion
• Understand requirements: MFA mandatory? Backups tested? Privileged access controls?
• Know claim process: who to call, documentation required, approval timeline
• Coverage limits adequate? (£2-5M minimum for mid-size orgs; £20-50M for large enterprises)
• Annual re-verification: Policies change, exclusions added, premiums spike

4. Pre-Identify and Retain Incident Response Specialists

Why this matters: During ransomware, you need forensics experts, negotiators, legal counsel, and crisis PR immediately. Finding these under crisis pressure wastes 2-5 days when every hour counts.

What to do:

• Forensics/IR firm: Pre-identify 2-3 firms, understand availability, have retainer or expedited onboarding process
• Legal counsel: Specialist in cyber incidents, data breach notification, regulatory response (not your general corporate counsel)
• Ransom negotiators: Specialists who deal with ransomware groups (can reduce ransom 20-50%)
• Crisis PR: Manage media, customer communication, reputation
• Law enforcement contacts: FBI (CyberDivision), NCA (NCSC), Europol—know who to call
• Document contacts in board-accessible location (not on encrypted systems!)

5. Identify and Segment Your "Crown Jewels"

Why this matters: Not all systems are equally critical. During ransomware, you need to know: What MUST we recover first? What can we live without temporarily? This prioritisation must be decided before crisis.

What to do:

• Business impact assessment: Which systems generate revenue? Process orders? Manage inventory? Handle payroll?
• Data classification: Customer data, IP, financial records, regulated data—what's most sensitive?
• Recovery priority: Tier 1 (must restore within 24h), Tier 2 (within 1 week), Tier 3 (when possible)
• Network segmentation: Crown jewels isolated from general network—if ransomware spreads, they're protected
• Board understanding: Board should know organisation's top 5-10 critical systems by name

6. Conduct Annual Tabletop Exercise with Board Participation

Why this matters: Plans look good on paper but fail under pressure. Tabletop exercises reveal gaps in authority, communication, decision-making, and coordination BEFORE real incident.

What to do:

• Scenario-based exercise: "It's 2 AM. Ransomware detected. 80% of systems encrypted. Attackers demand £15M in 48 hours."
• Board participation: Chair, CEO, key board members walk through actual decisions they'd make
• Test decision points: Who has authority to pay ransom? How do we communicate to customers? When do we notify regulators?
• Identify gaps: Missing contacts, unclear authority, communication breakdowns, technical misunderstandings
• Update plans: Revise response plan based on lessons learned
• Annual repetition: People change, technology changes, threats evolve—exercise annually minimum

7. Prepare Communication Templates and Stakeholder Lists

Why this matters: During ransomware, you must communicate with multiple stakeholders under tight deadlines: customers, employees, regulators, media, partners. You cannot write these messages from scratch under crisis pressure.

What to do:

• Pre-approved templates: Initial notification, status updates, resolution announcement (legal counsel reviews)
• Stakeholder matrix: Who needs to know what, when? (Board → 0-4h, Customers → 24-48h, Media → case-by-case)
• Contact lists maintained: Customer emails, employee contact details, regulator contacts, media contacts
• Regulatory notifications: GDPR 72-hour requirement, sector-specific obligations (documented and ready)
• "One voice" principle: Designate single spokesperson (CEO or crisis PR), all others refer to them
• Website banner template: Pre-designed incident notification banner for homepage

8. Implement Privileged Access Management (PAM)

Why this matters: 80% of ransomware attacks involve compromised privileged accounts. Attackers use admin credentials to disable backups, deploy ransomware across entire network, and maximise damage.

What to do:

• PAM solution required: Vaults that secure privileged credentials, require approval for access, rotate passwords automatically
• Just-in-Time access: Admin privileges granted only when needed, for limited time, with approval workflow
• Session recording: All privileged sessions recorded for forensic investigation
• No standing admin rights: Even IT staff work with standard accounts, elevate only when needed
• MFA for all privileged access: Phishing-resistant MFA (hardware keys) required for any admin action

9. Deploy Endpoint Detection and Response (EDR) Across All Systems

Why this matters: Traditional antivirus detects known ransomware signatures. Modern ransomware is polymorphic (changes signatures constantly). EDR detects malicious behaviour patterns, not just signatures.

What to do:

• EDR on all endpoints: Laptops, desktops, servers, virtual machines—no exceptions
• Behavioural detection: Identifies ransomware by encryption behaviour, not just signatures
• Automated response: Isolates infected devices immediately, prevents spread
• 24/7 monitoring: SOC (Security Operations Center) or MDR (Managed Detection & Response) actively watching
• Integration with IR plan: EDR alerts trigger incident response procedures automatically
• Regular testing: Purple team exercises ensure EDR actually detects/blocks ransomware

10. Document Everything in Board-Accessible "Ransomware Playbook"

Why this matters: All the preparation above is worthless if board/executives can't access it during incident (your systems may be encrypted!). Single, simple document with all critical information.

What to do:

• 1-page emergency response card: Laminated card for each board member with critical contacts, decision tree
• Ransomware playbook (10-15 pages): Decision frameworks, contact lists, communication templates, regulatory requirements
• Accessible location: NOT on corporate network (it may be encrypted). Board portal, personal devices, printed copies
• Quarterly review: Update contacts, refine frameworks, incorporate lessons from exercises or industry incidents
• Legal privilege protection: Mark as "Attorney Work Product" where appropriate to protect from discovery

ROI: 1,800% - 19,000% (even if incident never occurs, peace of mind and board confidence alone justify investment)

The question is not "if" but "when."

Organisations that prepare BEFORE attack recover 10x faster, reduce costs by 60-80%, and make better decisions under pressure. Those that don't face catastrophic losses that could have been prevented.

About CyberCQR

CyberCQR helps boards prepare for ransomware through strategic assessments, tabletop exercises, and incident response planning. Our Board Ransomware Preparedness service ensures your organisation is ready for the inevitable attack.

Document ID: THREAT-TOP10-001 | Version: 1.0 | Date: 06 January 2026 | Series: Top 10 for Ransomware & Threats