Three jobs sit behind how to prevent ransomware: make the way in harder, limit how far an attacker can reach, and restore from your own copies. This guide sets them out as seven steps. It is for an IT head or manager at a firm of roughly 250 to 2,000 people in India or the GCC. The firm has a small IT team but no dedicated security team. Each step has an owner and a one-line check, and the last step is the ransomware recovery runbook. If you need the background first, read what ransomware is. The sources speak to other places. CISA writes for US organisations. The NCSC writes for UK large organisations and the public sector, while NIST writes for any organisation. This guide makes no claim about Indian or GCC rules. Also, no set of controls is complete.
Last reviewed 2026-11-01 by Manish Sharma.
How to Prevent Ransomware: Seven Steps in the Order a Team Can Act
One or two administrators can finish Steps 1 to 3. Steps 4 and 5 need line managers and the network and directory teams, while Step 6 sits with the backup owner. Step 7 needs the business owners. The order says who can finish first, but it does not say which step matters most. It is Signisys’ own, as are the owner and Check lines.
Each step also carries a group label from NIST IR 8374 Rev. 1, which NIST published in June 2026 as a Community Profile of its Cybersecurity Framework 2.0. It is guidance and not a regulation, and NIST wrote it for any organisation, regardless of sector or size.
Key Takeaway Do what one administrator can finish. Start recovery planning at the same time, as it needs the business owners’ time.
How to Prevent Ransomware, Step 1: Close and Patch What Faces the Internet
Who acts: a network or systems administrator. Label: NIST group 3 (avoid having vulnerabilities in systems that ransomware could exploit) and group 5 (make it harder for ransomware to spread).
A small team can work through this part alone, without waiting for another team. CISA’s #StopRansomware Guide, version 3.0 of October 2023, speaks to US organisations. It says not to expose remote desktop to the internet. If remote desktop must stay exposed, add compensating controls. CISA also says to limit remote desktop and close unused ports such as TCP 3389. It adds that you should enforce account lockouts, apply MFA and log attempts. It also says to implement MFA on all VPN connections. If MFA is not in place, require teleworkers to use passwords of 15 or more characters.
When patching, CISA says to scan internet-facing devices for vulnerabilities. It also says to prioritise timely patching of internet-facing servers, especially for known exploited vulnerabilities. Another step is to update VPNs and network infrastructure devices with the latest patches. Finally, disable SMB 1.0, and block TCP port 445 inbound and outbound at the internet perimeter firewalls.
The NCSC’s Mitigating malware and ransomware attacks, reviewed on 9 September 2021, also agrees. The NCSC writes for cyber security professionals, large organisations and the public sector. It says to disable RDP if you do not need it and to use MFA at all remote access points. It also says to allow-list IP addresses on hardware firewalls. Last, patch known vulnerabilities in remote-access and external-facing devices immediately.
Check: a list of every internet-facing system with its patch status. No remote desktop port is reachable from the internet when you test from outside.
Step 2: Protect Sign-Ins and Admin Accounts
Who acts: an identity or directory administrator. Label: NIST group 5 (make it harder for ransomware to spread).
CISA’s guide asks for phishing-resistant MFA on all services, including email, VPNs and accounts that reach critical systems. If MFA is missing or not enforced, it says to escalate to senior management. It also asks for unique passwords of at least 15 characters and for account lockout. It asks for changed default admin credentials as well as no root accounts for daily work. Read more on multi-factor authentication if the term is new.
NIST adds that people should use standard user accounts with MFA instead of administrative accounts whenever possible. It also says each account should hold only the access it needs. The NCSC also says administrators should avoid using admin accounts for email and web browsing. In practice, privileged access management is the label for controlling admin accounts such as these.
Use one admin account for admin work and one ordinary account for everything else. This is a Signisys suggestion.
Check: a report of accounts without MFA that a senior person reviews. Also, no administrator account used to read email.
How to Prevent Ransomware, Step 3: Filter Email and Block Unapproved Software
Who acts: an email or endpoint administrator. Label: NIST groups 3 and 4.
Email and software are another pair of doors. One administrator can close both. CISA says to flag external email and to disable macros in office documents sent by email. It also asks for application allow-listing, endpoint detection and response, or both, on all assets. The aim is to let only authorised software run. CISA prefers allow-listing to trying to list and block everything bad. See endpoint detection and response and phishing for plain definitions if either term is new.
NIST agrees on allowing only authorised applications. It also adds malware detection software set to scan email and flash drives automatically. The NCSC points to measures including mail filtering, blocking known-malicious sites and central management of devices. That management lets only trusted applications run. It also advises you to consider whether enterprise antivirus or anti-malware products are necessary. If you use them, keep the software and its definition files up to date. Our guide to choosing between antivirus, EDR and XDR compares the three by who has to act on the alerts.
Detection is a separate job, but it gets one line here. NIST’s group 4 includes monitoring of directory services, while why attacks go unnoticed explains why detection fails.
Check: a list of endpoints without the protection, and the date you last reviewed the allow-list policy.
Step 4: Train Staff and Make Reporting Safe
Who acts: the IT head with line managers. Label: NIST group 2 (educate employees).
Training does not replace the technical steps. But it supports them. NIST suggests phishing and social media simulations. It also suggests training on the risk of connecting personal devices to work networks. NIST asks for a culture of incident reporting that avoids blaming employees. That culture should encourage them to notify security at once. CISA also lists user awareness training and a way to report suspicious activity.
In practice, a reporting route works when staff know where to send a message and expect to be thanked.
Use one shared mailbox or one chat channel, named in the induction pack. This is a Signisys suggestion.
Check: staff know the one way to report something suspicious, and a report made in error gets thanks, not blame.
How to Prevent Ransomware, Step 5: Limit How Far an Attacker Can Reach
Who acts: the network and directory teams. Label: NIST group 5 (make it harder for ransomware to spread).
Steps 1 to 4 keep attackers out. This step covers how to prevent ransomware from spreading once an attacker has one account or device. NIST points to zero trust principles and to segmenting internal networks if practical. It also points to least privilege, with a check that each account has only the access it needs. It adds a secure VPN for outside access. See zero trust and network segmentation for definitions if the terms are new.
CISA says segmentation helps contain an intrusion and limit lateral movement. But it warns that user error or non-adherence to policy can undo it. It also says to block or limit internal SMB, with traffic flowing only between systems that need it. In CISA’s example, domain controllers need SMB traffic for group policy. In the same example, most workstations do not need to access other workstations. CISA also says malicious actors often target and use domain controllers, which run Active Directory, as a staging point to spread ransomware network wide. It asks you to secure these domain controllers. When the segments exist, keep a network diagram that shows them. Our guide to nine steps for a safer network, in order includes a step on splitting the network.
Check: a diagram of the segments with the allowed paths written down. Also, a list of who can administer the domain controllers.
Step 6: Keep Backups Out of the Attacker’s Reach
Who acts: the backup owner, meaning the person who runs the backup tool. Label: NIST group 6 (make it easier to recover from a future ransomware event) and group 5.
CISA says to keep offline, encrypted backups of critical data. It also says to test their availability and integrity in a disaster recovery scenario. It adds that attackers try to find and delete or encrypt backups when they can reach them. They also collect credentials to get into backup solutions and use public exploits against unpatched backup products. CISA also warns that automated cloud backups may not be sufficient. If an attacker encrypts local files, they will sync to the cloud, possibly overwriting unaffected data. CISA says to use immutable storage with caution. It notes that immutable storage does not meet the compliance criteria of certain regulations, and that a misconfiguration can impose significant cost.
The NCSC’s page lists measures including offline backups kept separate and not permanently connected, and multiple copies across different solutions and locations. It also says to make sure a cloud service protects previous versions of the backup from being immediately deleted. Connect backups only to known-clean devices before recovery, scan them for malware before restoring and patch the backup products regularly. Ideally, protect backup accounts and solutions with privileged access workstations, as well as hardware firewalls to enforce IP allow-listing. It separately says to enable MFA, but with the MFA method not installed on the device used to administer backups.
Check: a named backup was restored into a test area and the result recorded. Also, the list of accounts that can delete or change backups holds no everyday administrator account.
Key Takeaway A backup helps with recovery when it can be restored.
How to Prevent Ransomware, Step 7: Write and Rehearse the Recovery Runbook
Who acts: the IT head with the business owners, who decide what comes back first. Label: NIST group 1 (plan for ransomware events) and group 6 (make it easier to recover from a future ransomware event).
Step 7 can start at the same time as Step 1. The critical-systems list and the named decision makers do not wait for the technical steps. The runbook below is a Signisys layout, but its items come from what CISA, the NCSC and NIST describe. Each item says what to write down and who signs it. If you want to know how restores go wrong in practice, see what fails at restore time.
Take it from CISA’s predefined critical asset list, and the business owner signs the order.
Name the person who confirms when a backup is safe to restore. This links to Step 6.
List them by role. NIST also asks you to know your decision makers.
NIST calls for an out-of-band communications strategy. CISA says to keep a hard copy of the plan and an offline version.
Include law enforcement, legal counsel and outside help.
NIST says to understand and manage the legal, regulatory and contractual requirements. Signisys suggests confirming them with your own legal adviser, but this guide makes no claim about Indian or GCC reporting rules.
Rehearse the Runbook and Test the Restore
A rehearsal tests the writing. CISA says to regularly exercise the plan, while the NCSC lists what an exercise should work out:
- how long it would take to restore the minimum required number of devices from images and re-configure them for use;
- how you would rebuild virtual environments and physical servers;
- what processes to follow if onsite systems and cloud backup servers are unusable;
- how you would continue to operate critical business services.
NIST also says to consider ransomware insurance. It says cover can help alleviate the financial pressure of a ransomware event, especially for small and medium size businesses. In our reading, insurance is a recovery measure, but it does not stop an attack. If you want the wider response plan, with roles and severity levels, see a separate six-step guide.
Check: someone who did not write the runbook restored one named system from it. Also, the business owner signed the order.
A runbook on paper is not a restore test. When you plan a real one, involve the IT owner and run it under change control. Keep it off production unless the system owner says yes.
What This Guide Does Not Cover
This guide on how to prevent ransomware leaves out what ransomware is, the general response plan, a tick-box checklist and a comparison of backup designs. It also leaves out detection, legal advice and advice on paying a ransom. CISA writes for US organisations and the NCSC for UK large organisations and the public sector. Their steps are not Indian or GCC rules. No control stops every attack. But a specialist is worth asking when your firm handles regulated data or has had an incident. If you want the wider picture, see the page on protecting against ransomware and recovering from it.
Signisys provides cybersecurity services for growing firms, and we can talk through your seven steps with you if that helps.
How to Prevent Ransomware: FAQ
What should a small IT team do first to prevent ransomware?
Does multi-factor authentication stop ransomware by itself?
Can backups alone protect against ransomware?
Is cyber insurance part of prevention?
Where does the incident response plan fit?
Security Insights, Delivered.
Practical, vendor-neutral analysis of threats, tools, and architecture decisions.