Community Library

ISO 27001 Ransomware Readiness Checklist

Ten checks that decide whether ransomware costs you a day or a month.

Join to save this for later.

Ransomware is a day or a month depending on whether the backup, the contacts, and the decision are already in place. Give this list to the people who would have to act. Each step also names the proof your ISO/IEC 27001 program should already be able to show.

How to use this checklist

1. Work the parts in order: prevent, recover, then respond.
2. The Proof line is the record your program keeps. If you cannot produce it, the task is not done.
3. References point to ISO/IEC 27001:2022 Annex A controls, for example A.8.13.
4. This is guidance. Work with your IT provider, insurer, and counsel. Keep one printed copy offline.

• 4Prevent
• 4Recover
• 2Respond

10 checks for ransomware readiness. Each one names the proof to keep and the ISO/IEC 27001:2022 control it supports.

Prevent · Before it happens

Prevent

Sign-in, patches, admin rights, and endpoint alerts are already in place.

0 of 4

• Turn on MFA everywhere people sign in, including email, VPN, remote access, and admin tools. Admins use phishing-resistant MFA.

  Proof: A record of where MFA is on, and which admin accounts use phishing-resistant MFA.

  A.8.5, A.5.17
• Patch exposed systems fast. Fix critical flaws in VPNs, firewalls, and remote access tools within days, not months.

  Proof: Patch record for those systems, with the date the critical fix was applied.

  A.8.8
• Limit admin rights. Few admins, separate admin accounts, and no email or browsing while signed in as admin.

  Proof: Admin account list, and the rule that admin accounts are not used for email or browsing.

  A.8.2
• Watch every endpoint. Endpoint detection on every laptop and server, with alerts someone watches around the clock.

  Proof: Coverage list of laptops and servers, and the name of who watches the alerts.

  A.8.7, A.8.16

Recover · If you have to come back

Recover

A backup they cannot encrypt, a restore you have timed, targets leaders agreed, and a paper contact list.

0 of 4

• Keep at least one backup copy offline or immutable, protected by separate credentials.

  Proof: Backup record naming the offline or immutable copy and the separate credentials.

  A.8.13
• Restore a critical system end to end at least twice a year, and record how long it took.

  Proof: Restore test record with the system, the date, and the time it took.

  A.8.13, A.5.30
• Agree how long each critical system can be down, and how much data you can lose.

  Proof: Written recovery targets for each critical system.

  A.5.29, A.5.30
• Print the contact list: incident lead, IT or provider, insurer, legal counsel, bank, and key staff. Email may be down.

  Proof: A printed copy stored offline, with a date.

  A.5.24, A.5.5

Respond · When it happens

Respond

Someone is named to decide, and the leaders have practiced once this year.

0 of 2

• Name who can shut systems off, call the insurer, and decide what to do about a ransom demand.

  Proof: Named decision makers on the incident plan.

  A.5.24, A.5.26
• Run a ransomware tabletop with leaders once a year, then fix the gaps it finds.

  Proof: Exercise record with the date, who came, and the gaps that were fixed.

  A.5.24, A.5.27

Want the backup test and the decision to live in the program, not in a binder no one opens?

Trygg keeps the restore test, the contact list, and the proof in one place.

Book a demoISO 27001 Preparation Checklist

Portal demos follow a mutual NDA.

This checklist is guidance, not a substitute for the ISO/IEC 27001:2022 standard. Purchase the standard from ISO or your national standards body. Certification decisions are made only by accredited certification bodies.