Ransomware Readiness: 10 Questions Your Leadership Should Answer

Ransomware attacks encrypt an organisation's systems and data, and often steal data too, then demand payment to restore access or prevent publication. They can stop operations for days or weeks, disrupt customers and supply chains, and create difficult legal, financial and reputational decisions.

Technical defences matter enormously, but readiness is not only a job for the IT department. When an attack happens, leaders must decide whether to shut systems down, how to keep operating, what to tell customers and regulators, and how to respond to extortion. Organisations that have thought through these questions in advance recover faster and with less damage.

Here are ten questions every leadership team should be able to answer.

1. Could we restore our critical systems from backups the attacker cannot reach?

Attackers routinely target backups, deleting or encrypting them before triggering the ransomware. Backups that are connected to the main network, or protected by the same administrator accounts, may not survive.

What good looks like: backups for critical systems that are isolated or immutable, protected by separate credentials, and restored successfully in a recent test.

2. Do we know which systems to restore first, and how long it will take?

Restoring everything at once is impossible. Without agreed priorities, recovery becomes a series of arguments under pressure.

What good looks like: recovery priorities agreed with the business in advance, based on which services matter most, with realistic recovery times that have been tested.

3. Could we rebuild our identity systems if they were compromised?

Attackers often take control of identity systems, such as directory services, to spread across the network. If those systems cannot be trusted, almost nothing else can be restored safely.

What good looks like: a plan, and the backups and documentation, to rebuild core identity and infrastructure from a known-good state.

4. Who decides to shut systems down, and how fast?

Isolating systems quickly can stop an attack spreading, but it also stops the business. Someone needs the authority to make that call, often in the middle of the night.

What good looks like: clear, documented decision authority, delegated appropriately, so the technical team can act quickly without waiting for a meeting.

5. How would we keep operating while systems are down?

Recovery can take days or weeks. In the meantime, customers still need serving and staff still need paying.

What good looks like: documented manual workarounds for critical processes, known to staff and practised, with priorities for which services to maintain.

6. What is our position on paying a ransom?

Paying is a legal, ethical and practical decision. Payment does not guarantee recovery or that stolen data will be deleted, and in some circumstances it may be unlawful, for example if payment would breach sanctions. Debating it for the first time during an attack, under pressure, leads to poor decisions.

What good looks like: the leadership team has discussed the organisation's position in advance, understands the legal considerations, knows who would make the decision and has identified the advisers it would consult.

7. Who do we call first?

Incident response specialists, legal advisers, insurers, and possibly law enforcement and regulators all have a role. Finding them during an attack wastes valuable hours.

What good looks like: pre-arranged support, such as an incident response retainer, with contact details available offline, and an understanding of what your insurer requires you to do and when.

8. How would we communicate if email and systems were down?

Attacks often take out the very tools used to coordinate a response.

What good looks like: alternative communication channels set up and tested, contact lists held offline, and templates prepared for staff, customers, partners and the media.

9. Do we know our legal and regulatory notification obligations?

Data theft may trigger data protection breach notification requirements with tight deadlines. Sector regulators and contracts with customers may impose others.

What good looks like: obligations mapped in advance, legal and privacy specialists part of the response team, and a process for making and recording notification decisions.

10. When did we last rehearse?

Plans that have never been exercised rarely work as written. Leaders who have rehearsed a ransomware scenario make better decisions under pressure.

What good looks like: a realistic tabletop exercise involving the executive team at least once a year, with actions tracked to completion. Our guide to testing business continuity plans covers how to design exercises that find real weaknesses.

Prevention still matters

These questions focus on readiness, because no defence is perfect. But reducing the chance of a successful attack matters too: multi-factor authentication everywhere, prompt patching of exposed systems, limited administrator access, good endpoint protection, and staff who recognise and report phishing. Our article on phishing simulations done right covers the human side.

How ready are you?

Updated October 2026: we have added an Incident Response & Cyber Resilience assessment. It covers preparation and planning, escalation and decision-making, containment and eradication, recovery and backup resilience, communication and legal obligations, and exercises and learning, many of the areas behind these ten questions.

For a broader view of security controls, the Enterprise Security assessment covers governance, identity, detection, data protection and culture.

Frequently asked questions

Is ransomware only a risk for large organisations?

No. Organisations of every size and sector are attacked. Smaller organisations can be attractive targets because they may have fewer defences and less capacity to recover.

Does cyber insurance cover ransomware?

Many policies include some cover, but terms vary and insurers increasingly require specific controls, such as multi-factor authentication and tested backups. Check what your policy covers and what it requires of you, before an incident.

How often should the board discuss ransomware readiness?

At least annually, and after any significant incident, exercise or change in the threat landscape. Many boards include cyber resilience as a regular item in risk reporting.