Ransomware resilience is broader than installing anti-malware. It includes reducing initial access, limiting privilege, segmenting systems, detecting suspicious behaviour and maintaining recovery copies that attackers cannot easily alter. Backups are a last line of defence and must be protected as carefully as production systems.
Define RPO and RTO
Recovery Point Objective (RPO) is the maximum tolerable amount of data loss measured in time. Recovery Time Objective (RTO) is the target time to restore a service. Business owners should set these targets based on operational impact, dependencies and contractual commitments.
Apply layered backup protection
Use application-aware backups where required, multiple recovery points, off-site copies and immutable or offline storage. Separate backup administration from production identities. Require MFA for backup consoles, restrict deletion permissions and monitor changes to retention, repositories and backup jobs.
Protect the recovery environment
Document clean recovery infrastructure, network isolation, trusted installation media, credentials and dependencies such as DNS, identity, certificates and databases. Ensure recovery procedures do not depend entirely on a compromised production domain or unavailable documentation platform.
Test more than job success
Perform scheduled file-level, application-item, virtual-machine and full-service restore tests. Validate permissions, application consistency, data integrity and business workflows. Record actual restore duration against RTO and actual data point against RPO. Track and fix gaps.
Ransomware response coordination
If ransomware is suspected, activate the incident plan, isolate affected systems safely, preserve evidence and involve security, infrastructure, legal and business owners. Do not reconnect systems until the source and persistence mechanisms have been addressed. Restore only from validated clean recovery points.
Resilience metrics
Track protected asset coverage, immutable-copy coverage, backup job success, restore-test success, actual RTO/RPO performance and backup administration MFA. Review results with service owners.
- Confirm the control has a named owner and documented business purpose.
- Validate configuration against current vendor guidance and organisational policy.
- Test expected and denied access paths; retain evidence of the result.
- Monitor exceptions, failures and configuration changes.
- Review the control after material infrastructure or business changes.
A backup strategy is credible only when recovery is isolated, documented and repeatedly demonstrated.