Ransomware is no longer just an IT problem. When it hits, sales stop, staff can't work and customers start asking questions. The good news is that most organisations can dramatically reduce their exposure by getting a handful of fundamentals right — and leaders don't need to be technical to check them.
Here are ten questions to ask your IT team or provider this quarter. If the answers are vague, that's your signal to dig deeper.
1. If our main file server were encrypted tonight, how long until we're working again?
This is the question that matters most. The answer should be a number of hours or days, backed by a recent restore test — not a guess. If nobody knows, start with a recovery test.
2. Do we have a backup copy that attackers can't delete?
Modern ransomware groups look for backups first. You need at least one copy that is offline or immutable, protected by separate credentials. The 3-2-1-1-0 rule is a good benchmark: three copies, two media types, one off-site, one offline or immutable, and zero errors in restore tests.
3. Is multi-factor authentication enforced everywhere it should be?
Email, remote access, VPNs, cloud admin consoles and backup systems should all require MFA — ideally phishing-resistant methods such as passkeys or security keys for administrators.
4. How quickly do we patch internet-facing systems?
Firewalls, VPN gateways and remote-access tools are frequent entry points. Ask how long critical patches take to deploy, and whether you track actively exploited vulnerabilities, such as those on CISA's Known Exploited Vulnerabilities catalogue.
5. Would we notice an intruder before they encrypt anything?
Attackers often spend days inside a network before launching ransomware. Endpoint detection and response (EDR) and someone actually reviewing alerts give you a chance to stop them early.
6. Can one compromised laptop reach everything?
A flat network lets ransomware spread freely. Segmentation keeps servers, backups and sensitive systems separate from everyday user devices.
7. Who has admin rights, and why?
Excess privileges make an attacker's job easy. Admin accounts should be few, separate from everyday accounts, protected by strong MFA and reviewed regularly.
8. Do we know our reporting obligations and deadlines?
Notification timelines can be short. In India, CERT-In requires specified cyber incidents to be reported within six hours of being noticed. Under the GDPR, qualifying personal data breaches must generally be notified to the supervisory authority within 72 hours. Your plan should list which rules apply to you and who makes the call.
9. Have we rehearsed the first hour?
A tabletop exercise — walking through a realistic scenario with leadership and IT — reveals gaps in contacts, decision rights and communication long before a real incident does.
10. Do our people know what to do when something looks wrong?
Staff who report a suspicious email quickly are one of your best defences. Make reporting easy, and thank people for doing it.
Next step: If more than two of these answers were uncertain, a short ransomware readiness assessment will show you where to focus first. Learn about our incident response and resilience service.
