A ransomware checklist tests four things before any attack: whether the way in is shut, whether the reach is limited, whether a backup survives and whether a restore works. This one suits an IT head, IT manager or business owner. The firm has roughly 250 to 2,000 people, a small IT team and a base in India or the GCC. It has 15 checks, each with the evidence to collect and a yes/no pass test. The score also works as a quick ransomware risk assessment of your own set-up. It is a self-check, not an independent assessment. It does not explain what ransomware is or list the steps to take during an attack.
Last reviewed 2026-11-01 by Manish Sharma.
Ransomware Checklist: What It Tests, and Which Sources Stand Behind It
The checklist tests readiness in three groups. Prevention is checks 1 to 7, backup is checks 8 to 11 and recovery is checks 12 to 15. Each check ends with the group it is placed under in NIST IR 8374 Rev. 1, published in June 2026 as a Community Profile of the Cybersecurity Framework 2.0. It is guidance and not a regulation. NIST wrote it for any organisation, regardless of sector or size. NIST’s six groups are: 1 plan for ransomware events; 2 educate employees on avoiding ransomware infections; 3 avoid having vulnerabilities in systems that ransomware could exploit; 4 quickly detect and stop ransomware attacks and infections; 5 make it harder for ransomware to spread; 6 make it easier to recover from a future ransomware event. NIST also says that not all of its measures will apply to the situations of all organisations.
The three groups, the 15 checks, the pass tests and the points are Signisys’ own organisation of these sources. Two more sources appear where they are used. One is a guide from US agencies, for US organisations. The other is a page from the UK’s National Cyber Security Centre (NCSC), for cyber security professionals, large organisations and the public sector. Neither sets Indian or GCC rules, and this article makes no claim about those. It is also not a certificate.
Key Takeaway A check counts only when someone who did not set it up can show it working, with a date.
How to Score the Ransomware Checklist
The scoring rule, the sampling rule and the not-applicable rule below are Signisys’ own. Mark each check:
- Pass, 2 points: when you meet the pass test and hold dated evidence.
- Partial, 1 point: if you meet the test for some systems or accounts, or the evidence is missing.
- Fail, 0 points: if you do not meet the test.
The total is out of 30, when all 15 checks score Pass. No target score or band comes with the checklist, as any band would be a guess. The useful number is the count of Fails in each group. No evidence means not passed, even if the team believes otherwise.
If a check does not apply, mark it not applicable and leave its 2 points out of the maximum. One such check makes the total out of 28. An example is check 11 when you use no cloud sync.
Where a test says “sample”, pick three people or accounts at random and write the picks down. That makes the result repeatable. Keep one dated folder with the name of the person who ran each check.
Record the date and the exact result, for example “scan found port 3389 closed”.
Ransomware Checklist: 15 Checks in Three Groups
Each table gives the check, the evidence to collect and the pass test. Signisys chose the NIST group at the end of each check, as it did the pass tests.
Checks 1 to 4: Prevention at the Internet Edge and at Sign-In
The #StopRansomware Guide, version 3.0 of October 2023 from CISA, NSA, FBI and MS-ISAC, is for US organisations. It advises disabling ports and protocols not used for business purposes, for example Remote Desktop Protocol on TCP port 3389. It also advises blocking TCP port 445 inbound and outbound at internet perimeter firewalls. The same guide advises prioritising timely patching of internet-facing servers and applying multi-factor authentication (MFA), a second sign-in step.
| Check | Evidence to collect | Pass test |
|---|---|---|
| 1) No remote desktop or file-sharing port is open to the internet (NIST group 3) | A dated outside port-scan result and the list of internet-facing systems | Yes, if a scan from outside shows TCP 3389 and TCP 445 closed and every open port on the list has an owner |
| 2) Internet-facing servers and devices are patched (NIST group 3) | Patch status and check date for each system on the list | Yes, when each one shows its latest security updates, or a dated, signed exception |
| 3) Remote access asks for a second sign-in step (NIST group 5) | The list of remote access routes with the MFA setting of each | Yes, if a test sign-in on every route asks for a second factor |
| 4) Admin work uses separate accounts with MFA (NIST group 5) | The admin account list with MFA status and the account used for email | Yes, if every admin account has MFA and each administrator has a separate everyday account |
Checks 5 to 7: Prevention in Email, Software, People and Spread
Checks 5 to 7 take the ransomware checklist from the edge into email, software, staff and the network inside. NIST’s group 3 asks for zero trust principles, including segmenting internal networks where practical. Check 7 tests whether network segmentation, which limits the paths between parts of the network, holds up in practice.
| Check | Evidence to collect | Pass test |
|---|---|---|
| 5) Email and software controls are switched on (NIST groups 3 and 4) | Mail filter settings and a report of devices without endpoint protection | Yes, if a harmless test attachment of a blocked type is stopped and each unprotected device has a written reason |
| 6) Staff know how to report something suspicious (NIST group 2) | The written reporting route and the policy line on blame | Yes, if three sampled staff name the route and the policy says honest mistakes are not blamed |
| 7) Spread inside the network is limited (NIST groups 3 and 5) | A diagram of segments with allowed paths, and the list of who administers domain controllers | Yes, if a test connection between two ordinary workstations is blocked unless the diagram lists the path, and each domain controller administrator is named |
Checks 8 to 11: Backup Out of Reach and Kept Safe
Checks 8 to 11 apply the ransomware checklist to the copies themselves, including who can delete them. The NCSC page Mitigating malware and ransomware attacks, reviewed 9 September 2021, as shown on the page, advises offline backups kept separate, in a different location, and multiple copies on different backup solutions and storage locations. It says MFA should be enabled for backup administration. Ideally, it also asks for privileged access workstations and hardware firewalls. CISA warns that automated cloud backups may not be sufficient, because if local files are encrypted by an attacker, these files will be synced to the cloud, possibly overwriting unaffected data.
| Check | Evidence to collect | Pass test |
|---|---|---|
| 8) One copy is out of reach of every everyday and admin account (NIST groups 5 and 6) | The copy list showing where each is kept and who can delete or change it | Yes, if no everyday administrator account can delete or change that copy, whatever protects it |
| 9) Backup accounts and software are protected (NIST group 6) | The backup admin list with the MFA method, and the software’s patch status | Yes, if every backup admin account uses MFA and the software shows its latest security updates |
| 10) More than one copy sits in more than one place (NIST group 6) | The copy list with the solution and location of each | Yes, when two or more copies sit on different backup solutions or locations and no single cloud service holds them all |
| 11) Cloud sync keeps earlier file versions (NIST group 6) | The version-retention setting and a dated test result | Yes, if a test file overwritten in the synced folder can be restored to its earlier version |
Checks 12 to 15: Recovery Is Clean, Equipped and Tried
Checks 12 to 15 of the ransomware checklist turn NIST’s recovery group into proof you can file. The NCSC advises connecting backups only to known clean devices and scanning them for malware before restoring.
| Check | Evidence to collect | Pass test |
|---|---|---|
| 12) A restore point is confirmed clean before use (NIST group 6) | The written steps for choosing and scanning a restore point, and who signs off | Yes, if the steps name who confirms the point is clean and a scan of a recent copy is on record |
| 13) Rebuild material is held where an attack does not reach (NIST group 6) | A list of system images, configuration code, installers and a printed plan, with where each is held | Yes, if one listed item was fetched without any production-network account and a printed recovery plan was found |
| 14) The protected copy has been restored in a test (NIST group 6) | A dated restore record naming the copy, the test area and who opened the data | Yes, if the restore used the copy from check 8, ran in an isolated area and a business user opened the restored data |
| 15) The ransomware recovery runbook has been walked through (NIST groups 1 and 6) | The runbook and a dated walk-through note | Yes, when someone who did not write it walked through it, and the note answers the NCSC’s questions: how long it takes to restore the minimum required devices from images and re-configure them, how to rebuild virtual environments and physical servers, and what processes to follow if onsite systems and cloud backup servers are unusable |
Turn Your Ransomware Checklist Score into a Fix List
Count the Fails in each group, as well as the total. We suggest this order, which is Signisys’ own. First come the checks that open the way in (1 to 4). Next comes the copy out of reach (8 and 9). The restore checks (12 to 15) follow, then the rest.
Use a seven-step risk assessment guide to order the remaining fixes. A repeat run turns the score into a result you can compare with the last one.
Signisys suggests handing over a findings list with an owner, a date and a re-test date for each Fail. Once a fix is in place, re-test the item with the same pass test. This page only checks the result, while Signisys’ seven-step guide on preventing ransomware covers how to do the fixes.
Key Takeaway Count the Fails in each group, as well as the total, and fix the way in first.
When to Ask for an Outside View
This is Signisys’ view, not a rule. An outside reader helps when you need an independent ransomware risk assessment, as this score is a self-check. It also helps when a customer, insurer or regulator asks for one. Read what each asks for before you decide, as this article makes no claim about their rules.
An outside view is useful as well when nobody outside IT can run the tests. The same goes for checks 8 and 14 that keep failing after a fix. In our view, an outsider adds a useful view on checks 8, 9, 14 and 15. Those cover the protected copy, backup accounts, the isolated restore and the runbook walk-through.
Signisys offers cybersecurity and data protection services. The offer stays in this section and the box below.
What This Checklist Does Not Cover
This page is a self-check of readiness. For the plan, roles and contacts, see the plan, team and contact checks. For a wider check of the whole network, use the network audit. Why restores fail after an attack shows how restores go wrong, while the seven-step guide holds the steps for each fix. The plan checks cover restore order from a critical-systems list, not this page. Our guide to comparing three backup designs by which copy survives covers the choice of design that this page leaves out.
It leaves out detection, what to do during an attack, the choice of backup design and legal advice. Neither the US guide nor the NCSC page sets Indian or GCC rules. No control stops every attack. A specialist is worth asking when the firm holds regulated data or has had an incident. For the wider picture, see protecting against ransomware and recovering from it.
Signisys provides cybersecurity services and data protection services for growing firms. The decisions on each gap stay with your own team.
Ransomware Checklist FAQ
What should a ransomware checklist include?
Who should run the checks?
Does a full score on the ransomware checklist mean a firm is safe?
Can a small IT team score it without outside help?
Is the ransomware checklist the same as the steps to follow during an attack?
When should the checks be run again?
Security Insights, Delivered.
Practical, vendor-neutral analysis of threats, tools, and architecture decisions.