Ransomware guide for UK organisations: before, during, after

The NCSC says ransomware attacks can be devastating because computer systems are no longer available to use, and in some cases data may never be recovered. It also says that how an organisation responds to and recovers from ransomware will hugely affect the impact of an attack. This guide sets out what to do before, during and after an attack, with links to our detailed guides on each part.

Before an attack

Keep a recent offline backup. The NCSC says up-to-date backups are the most effective way of recovering from a ransomware attack, and that it is essential to always have a recent offline backup of your most important files and data. It warns that attackers have destroyed copied files or disrupted recovery processes before launching attacks, so backups need protecting too. The NCSC says multi-factor authentication should be enabled for backups, and the MFA method should not be on the same device used to administer them. Our guides to immutable vs air-gapped backups and business backup and recovery cover how.

Close the common way in. The NCSC says ransomware is increasingly deployed by attackers who have gained access remotely through exposed services such as Remote Desktop Protocol (RDP), or unpatched remote access devices. In our view, review what is exposed to the internet and keep remote access devices patched.

Meet a baseline. The NCSC says all businesses should strengthen their defences using proven frameworks such as Cyber Essentials. Our guide to Cyber Essentials vs Cyber Essentials Plus explains the scheme.

Watch for attackers. In our view, detection tools help spot an intruder before encryption starts. Our guide to MDR vs EDR vs XDR explains the options.

Plan and rehearse. The government urges organisations to have offline backups, tested plans to operate without IT for an extended period, and a well-rehearsed strategy for restoring systems from backups. The NCSC says an incident response plan should be linked to business continuity, disaster recovery and communications plans. Our ransomware recovery and incident response plan guide sets out what to include, and our guide to how often to test DR plans covers rehearsals.

During an attack

Work through the stages. The NCSC's four core response stages are analyse, contain, remediate and recover. It says the initial priority is usually to understand enough to take containment actions, and that this may need critical decisions such as taking a core business system offline. In some cases, it says, it may be better to monitor and analyse further before acting.

Keep records. The NCSC says it is sensible to record decision-making offline, or on systems not affected by the incident.

Tell the right people. If personal data is involved and a risk to people is likely, the ICO says you must notify it as soon as possible and where feasible within 72 hours, and tell the people affected without undue delay if the risk to them is high. UK organisations can report a cyber incident to the NCSC. If you have cyber insurance, the NCSC says to report the attack to your insurer or broker.

Get expert help. The NCSC says there are two levels of NCSC Assured Cyber Incident Response that can help organisations recover from an incident.

The ransom decision

The NCSC and UK law enforcement do not encourage, endorse or condone paying ransom demands. The NCSC says criminals will try to convince you that payment is the only way to recover, but you might have viable backups or other ways to recover systems and data.

The government proposes to ban public sector bodies and operators of critical national infrastructure from paying ransoms, to require other businesses to notify the government of any intent to pay, and is developing mandatory reporting. Our guide to whether you should pay a ransomware demand covers the UK position in detail.

After an attack

Recover clean systems and data, then review what happened. The ICO says that when reporting, you should give as much detail as possible, even if information is likely to change, and its guidance now stresses reporting early and updating later. In our view, feed the lessons into your backups, your plan and your next exercise.

FAQ

How do I protect my organisation from ransomware?

The NCSC stresses always having a recent offline backup of your most important data, protecting backups with multi-factor authentication, and closing remote access routes such as exposed RDP and unpatched remote access devices, which attackers increasingly use to get in.

What should we do first in a ransomware attack?

The NCSC says the initial priority is usually to understand enough to take containment actions. Its four core response stages are analyse, contain, remediate and recover, and it advises recording decisions offline or on systems not affected by the incident.

Should we pay a ransomware demand?

The NCSC and UK law enforcement do not encourage, endorse or condone paying ransom demands. The NCSC says criminals will try to convince you payment is the only way to recover, but you might have viable backups or other ways to recover.

Do we have to report a ransomware attack?

If personal data is involved and a risk to people is likely, you must notify the ICO as soon as possible and where feasible within 72 hours. UK organisations can also report a cyber incident to the NCSC, and you should tell your insurer if you have cyber insurance.

Is paying a ransom being banned in the UK?

The government proposes to ban public sector bodies and operators of critical national infrastructure from paying ransoms and to require other businesses to notify the government of any intent to pay, and is developing mandatory reporting.