Ransomware Readiness Checklist
An interactive readiness checklist covering the controls that most consistently reduce ransomware impact -- offline backups, segmentation, detection, and a tested response plan.
Ransomware readiness assessment — 10 questions that reveal whether your organisation can survive an attack.
Ransomware is the most financially damaging type of cyberattack affecting Indian organisations. According to CERT-In's annual reports, ransomware incidents increased significantly year-over-year, with attacks targeting Indian healthcare, manufacturing, financial services, and government organisations. The average ransom demand has increased, and modern ransomware groups now combine encryption with data exfiltration — threatening to publish stolen data publicly even if the victim recovers from backup.
Ransomware readiness is not primarily a technical question — it is an operational one. Organisations with excellent technical controls but poor backup practices, untested recovery procedures, or no incident communication plan fare no better in an attack than those with weaker technical controls and good backups. This assessment evaluates ten dimensions of ransomware readiness that directly determine whether an organisation recovers in days or weeks: backup coverage and immutability, backup restoration testing, network segmentation, endpoint detection and response capability, privileged access controls, patch management, business continuity planning, incident response plan existence and testing, CERT-In notification capability, and cyber insurance coverage.
Each question in the assessment produces a score and specific, actionable guidance. A score of 8/10 or higher indicates strong ransomware readiness. Scores below 5/10 indicate significant gaps that substantially increase both the probability of a successful attack and the recovery time and cost if one occurs.
Frequently asked questions
What backup practices protect against ransomware?
Effective backup practices for ransomware protection follow the 3-2-1-1 rule: 3 copies of data, on 2 different media types, 1 offsite copy, 1 offline (air-gapped) copy. The offline copy is critical — ransomware increasingly targets backup systems specifically to prevent recovery without paying the ransom. Immutable backups (S3 Object Lock, Azure Immutable Blob, WORM tape) prevent encryption or deletion even if backup system credentials are compromised. Equally important: test restoration regularly. Many organisations discover that their backups do not actually restore cleanly only during an incident — when it is too late to fix the problem.
Should Indian organisations pay ransomware demands?
Payment is a legal and business decision that must involve legal counsel, cyber insurance carriers, and senior leadership — not a technical team decision alone. Key factors: whether a working decryption tool exists (check nomoreransom.org for your specific ransomware variant), whether backup recovery is feasible within an acceptable timeframe, and the legal implications of payment. Indian law does not currently prohibit ransomware payments, but payment to sanctioned entities could create legal risk regardless of jurisdiction. Cyber insurance policies typically have specific requirements around notifying the insurer before payment decisions are made. Payment does not guarantee data recovery or prevent data publication by groups that have already exfiltrated it.
What is the CERT-In reporting obligation for a ransomware attack?
Ransomware attacks are explicitly listed in the 20 notifiable incident types under CERT-In Directions 2022. Any organisation in India that experiences a ransomware attack must report it to CERT-In within six hours of becoming aware of the incident. The initial report should include: organisation details, incident description, affected systems, what data may have been affected, and actions taken. The six-hour clock starts when anyone in the organisation first becomes aware — not when the incident is confirmed or fully understood. File an initial report immediately and update it as investigation progresses. Use the CERT-In Deadline Calculator to track your reporting deadline precisely.
What is network segmentation and how does it limit ransomware spread?
Network segmentation divides a network into isolated zones — servers, workstations, IoT, guest — with firewall rules controlling which zones can communicate. In a flat (unsegmented) network, ransomware that infects one workstation can spread to all other workstations and servers because there is no network-level barrier to lateral movement. In a segmented network, the infected workstation is isolated to its zone — it cannot directly reach the server zone or other critical systems. Proper segmentation can limit a ransomware outbreak to a single zone rather than the entire organisation. Combined with endpoint isolation capability (EDR network isolation), segmentation is one of the most impactful containment controls available.