Ransomware preparedness: ten actions before an attack

1. Agree the board's position on paying a ransom, before an attack

Why it matters. During an attack, the pressure to decide quickly is intense, and the decision has legal, regulatory and ethical sides. Law enforcement does not encourage, endorse or condone paying [8]. Paying does not reduce enforcement action by the Information Commissioner's Office (ICO), although early engagement with the NCSC is taken into account [9]. Paying a group that is subject to UK financial sanctions can be a breach of sanctions law, and the Office of Financial Sanctions Implementation (OFSI) can impose penalties even where the payer did not know [10].

What to do.

• Record the organisation's position: whether it would ever pay, and on what conditions.
• Name who can authorise a payment, and their deputies, so the decision cannot stall.
• Require legal advice on sanctions, insurance and reporting before any payment.
• Minute the position and review it every year.

The government plans to ban ransom payments by the public sector and regulated critical national infrastructure, and to make reporting compulsory. At the time of writing these proposals were not yet law, and most private firms would not be covered by the ban [11].

2. Keep backups an attacker cannot reach, and prove they restore

Why it matters. Attackers look for connected backups and destroy them before they lock anything else. The NCSC recommends several copies in different places, at least one of them offline, and regular restore tests [8][17]. Backing up is common: 95% of medium and 90% of large UK businesses do it [4]. Restoring a critical system after an attack is a different test, and the one that counts.

What to do.

• Keep at least one copy that cannot be changed or deleted from the network: offline, or locked so it is immutable.
• Back up the systems that control access and configuration, not only the files.
• Restore a critical system end to end at least twice a year, time it, and report the result to the board.

3. Read the cyber insurance policy, not the summary

Why it matters. Malware and ransomware made up 51% of UK cyber insurance claims in 2024, up from 32% the year before, and insurers paid £197 million in total [12]. A policy is only as good as the answers on the proposal form: if the controls you declared are not really in place, the claim is at risk.

What to do.

• Read the exclusions and conditions, for example those covering multi-factor authentication (MFA), backups and patching.
• Check that what the proposal form said is still true, before every renewal.
• Know the claim process and which specialists the insurer will send.

4. Choose specialist help before you need it

Why it matters. Finding an incident response firm, specialist lawyers and crisis communications support in the middle of an attack costs days. The NCSC runs an assured Cyber Incident Response scheme for exactly this purpose [18], and many insurers have their own panel.

What to do.

• Choose an incident response firm, from the NCSC-assured scheme or your insurer's panel, and agree how to engage it at short notice.
• Choose specialist legal advice for breach notification and regulatory response.
• Arrange crisis communications support.
• Know how to report: to the NCSC, and to Report Fraud, which replaced Action Fraud as the national reporting service [19].
• Keep every contact somewhere that works when your own systems do not.

5. Know your critical systems and the order to restore them

Why it matters. Not every system matters equally. Arguing about what to restore first, during an attack, wastes the days that matter most. The NCSC advises identifying critical assets as part of planning for an attack [8].

What to do.

• List the five to ten systems the business cannot run without, and the data that would cause most harm if published.
• Set a target restore time for each: hours, days or weeks.
• Separate the most critical systems on the network so an attack does not reach them easily.
• Have the board agree the order.

6. Rehearse with the board every year

Why it matters. Plans look complete until someone has to use them. The government's Cyber Governance Code of Practice asks boards to gain assurance that the incident plan is exercised at least once a year, with lessons fed back into the plan [13]. The NCSC assures firms that run exercises under its Cyber Incident Exercising scheme [20].

What to do.

• Run a tabletop exercise where data is stolen as well as systems locked.
• Include the payment decision, the regulator notice and the message to clients.
• Record what was unclear, fix it, and repeat next year.

7. Prepare who you tell, and when

Why it matters. An attack starts several clocks at once. Where personal data is at risk, the ICO must be told within 72 hours of the organisation becoming aware [16]. Regulators such as the Financial Conduct Authority (FCA) and the Solicitors Regulation Authority (SRA) have their own expectations. Yet only 40% of UK businesses reported their most disruptive breach to anyone outside the organisation [4].

What to do.

• List who must be told, by when: the ICO, your sector regulator, insurers, the NCSC and Report Fraud, clients and staff.
• Draft template messages now, and have them checked by your lawyers.
• Name one spokesperson.
• Plan how to communicate if email and the intranet are down.

8. Control administrator access

Why it matters. An attacker with an administrator account can switch off backups and security tools and spread across the network. The NCSC advises MFA at every remote access point [8]. In March 2025 the ICO fined a software provider £3.07 million after a ransomware attack that began through an account without MFA [14].

What to do.

• MFA on email, remote access and every administrator account, using phishing-resistant methods such as passkeys or security keys for administrators.
• Separate administrator accounts, used only for administration.
• Grant administrator rights when needed and for a limited time, not permanently.
• Review who holds administrator rights every quarter.

9. Fix exposed weaknesses quickly, and detect what gets through

Why it matters. Exploited software flaws were the way in for 20% of breaches in Verizon's 2025 data [15]. Many victims stay exposed even after an attack: when Black Kite rescanned them, 43.5% still had a critical vulnerability and 30.8% still had a flaw known to be actively exploited [1]. Encryption is usually the last stage of an attack; the earlier stages are when it can still be stopped.

What to do.

• Keep a list of every internet-facing system and patch known flaws in them straight away, as the NCSC advises [8].
• Run endpoint detection and response (EDR) on every laptop and server.
• Make sure someone watches alerts out of hours, in-house or through a provider.
• Agree in advance who may isolate a device or cut a connection without waiting for sign-off.

10. Keep the playbook where you can reach it offline

Why it matters. All of the above is useless if it sits on systems that have just been locked. The board needs the essentials on paper and on devices outside the corporate network.

What to do.

• A one-page card for each director: who to call, who decides, and the first three steps.
• A short playbook with the payment position, contact lists, notification deadlines and message templates.
• Copies held off the network, in print and on personal devices.
• Review it every quarter, and after every exercise.
• Ask your lawyers whether incident reports should be prepared under legal privilege.