What to remember.
- Backup without tested recovery is not a sufficient plan.
- The incident plan must separate containment, investigation, recovery and communication.
- Recovery begins with clean identity and business priorities.
The management answer
Ransomware resilience means the organisation can contain spread, make decisions under pressure, restore priority services and verify that identities and systems are clean. A data copy alone does not repair compromised accounts, applications, configurations and business dependencies.
The plan should cover preparation, the first hours of response and the order of safe restoration.
Before an incident
Reduce privileges, protect administrative and remote access with strong MFA, patch exposed systems and segment critical resources. Monitoring should detect unusual account behaviour, mass file changes, disabled protection and movement between systems.
Maintain separate, protected copies of critical data and configuration. CISA recommends offline or immutable, encrypted backups and regular tests of their availability and integrity in a recovery scenario.
During an incident
The first objective is to contain spread and preserve evidence. Isolate affected segments according to the plan, avoid indiscriminately shutting down systems that may hold valuable evidence, and involve owners for security, legal obligations, communication and business priorities.
Maintain a decision timeline. Record when the issue was noticed, affected systems, actions taken and approvals. Otherwise, teams rely on memory at the most stressful point.
Safe recovery
Recovery does not begin by restoring everything. Establish a clean administration environment, verify identities and choose priorities according to business impact. Then restore systems in controlled waves.
Check every restored service technically and with business users. If a vulnerable configuration or compromised identity is restored, the incident can begin again.
Exercise before the crisis
- Who declares an incident and activates the team?
- How do we communicate if email and directory services are unavailable?
- Which systems are restored first, and why?
- Where are recovery credentials and documentation?
- Who approves production return?
- How are client and regulatory obligations checked?
The CoreTech approach
We connect resilience with infrastructure, identity, backup, monitoring and business priorities. An exercise should reveal the real recovery time and every point where a decision depends on one person or an untested assumption.
Common questions
Does antivirus stop ransomware?
It can prevent part of the threat, but resilience requires layers: identity, patching, segmentation, monitoring, backup and prepared response.
Why should copies be immutable or offline?
So that a compromised administrator account or malware cannot change or delete them together with production data.
Do we restore the largest system first?
Not necessarily. Business criticality and dependencies determine the sequence. A small service may need restoration before a larger system that depends on it.