Ransomware · Readiness
Service group: CybersecurityBe ready for ransomware before it reaches you
We look at your organization the way a ransomware group would: how they could get in, how far they could spread, whether they could destroy your backups, and how your team would decide what to do. Then we close the gaps in priority order.
At a glance
- Service
- A focused ransomware readiness review and remediation programme covering entry, spread, backups and recovery decisions
- Best suited to
- Organizations of roughly 5 to 200 employees that could not operate for long without their files and systems
- Core inclusions
- Readiness review, entry point and lateral movement controls, backup isolation check, ransomware playbook and a tabletop exercise
- Not included
- Ransom negotiation or payment, cryptocurrency handling, forensic investigation, legal advice and penetration testing
- Reference guidance
- Canadian Centre for Cyber Security ransomware guidance and baseline controls, and CIS Controls safeguards
- Pricing basis
- Fixed fee for the readiness review and playbook; remediation quoted separately, all confirmed in writing
- How to start
- Book a consultation to scope the readiness review
What ransomware preparedness involves
Ransomware attacks against smaller organizations usually follow a predictable path. Attackers get in through a phished password, an exposed remote access service or an unpatched device. They gain administrator privileges, move to servers and file shares, delete or encrypt backups, often copy data to threaten publication, and finally encrypt systems and demand payment.
Ransomware preparedness addresses each stage. It reduces the ways in, limits how far an intruder can move, makes sure at least one backup survives, and prepares leadership for the decisions they will face in the first hours: who to call, what to shut down, how to communicate and how to restore.
This differs from general backup or security services because it is organized around a single threat scenario and ends with a rehearsal. The result is a short list of high-value fixes and a team that has already thought through a bad day.
Gaps ransomware exploits
Exposed remote access
Remote desktop or ageing VPN appliances open to the internet without MFA or current patches.
Flat networks and broad admin rights
Every computer can reach every server, and too many accounts can administer them.
Backups on the same domain
An attacker who takes over a domain admin account can also delete every backup.
No decision plan
Leadership has never discussed who decides to shut systems down, contact the insurer or notify clients.
What we review and strengthen
Entry points
MFA on email and remote access, exposed services on your public IP addresses, email filtering and patch levels of internet-facing systems.
Privilege and spread
Administrator account sprawl, local admin rights, network segmentation between workstations and servers, and attack surface reduction rules.
Detection
Whether endpoint protection and EDR are deployed everywhere with ransomware protections enabled, and who sees their alerts.
Backup survival
Immutable or offline copies, separate backup credentials, and a recent full-system restore test.
Ransomware playbook
A written first-hours playbook: isolation steps, contact list for insurer, legal advisers and a forensic firm, communication templates and recovery order.
Tabletop exercise
A facilitated scenario walkthrough with leadership to test the playbook and expose unclear decisions.
Scope
Included in the readiness engagement
- Review of entry points, privilege, detection and backup controls against ransomware guidance
- External exposure check of your public IP addresses
- Backup isolation review and witnessed restore test of one key system
- Prioritized remediation list
- Ransomware response playbook tailored to your organization
- One facilitated tabletop exercise with leadership
Not included
- Ransom negotiation, payment facilitation or cryptocurrency handling
- Digital forensics or determining the scope of data theft
- Legal advice, including PIPEDA breach reporting decisions
- Penetration testing or simulated attacks
- Remediation work, which is quoted separately
Technologies commonly involved
- Microsoft Entra ID, MFA and conditional access
- Microsoft Defender for Endpoint or Business with attack surface reduction and controlled folder access
- Business firewalls, VPN and network segmentation
- Backup platforms with immutable cloud storage
- Microsoft Intune and local administrator password solutions such as Windows LAPS
- Canadian Centre for Cyber Security ransomware playbook guidance
Who should do this
Operations-dependent businesses
Manufacturers, construction firms and clinics that stop working when systems are encrypted.
Organizations with on-premises servers
Businesses with file and application servers that ransomware groups typically target first.
Leadership teams wanting a plan
Owners and boards who want to know what they would do, not just what technology is installed.
Benefits
- Common ransomware entry points identified and prioritized for closure
- Better odds that a clean backup survives an attack
- Leadership that has rehearsed the first hours of a crisis
- Clear contacts and decisions documented before they are needed
- Better-supported answers on cyber insurance applications
How the engagement runs
Scoping
We agree systems, sites and participants and arrange read-only access.
Readiness review
We assess entry, spread, detection and backup controls and check external exposure.
Restore test
We witness a restore of one key system to confirm recovery is possible.
Playbook and findings
You receive prioritized fixes and a tailored ransomware playbook.
Tabletop exercise
Leadership walks through a realistic scenario and we update the playbook with what was learned.
Ways to buy
Fees are proposed and confirmed in a written quotation.
Ransomware readiness engagement
The fixed-fee review, playbook and tabletop exercise described here.
Remediation project
A separately quoted project to close the gaps found, by our team or yours.
Ongoing protection
Managed endpoint security, backup and identity services to keep controls in place afterwards.
Frequently asked questions
Should we pay a ransom if we are attacked?
That is a business and legal decision for leadership, your insurer and legal advisers. Payment does not ensure data recovery or deletion of stolen data. Our aim is to give you recovery options so you are not forced into that choice.
Can you make us immune to ransomware?
No. We reduce the likelihood and impact of an attack and prepare you to recover. Remaining risk is documented so leadership can make informed decisions.
Do we have to report a ransomware attack?
Under PIPEDA, organizations must report breaches of security safeguards involving personal information that create a real risk of significant harm, and keep records of all breaches. Provincial laws and contracts may add obligations. Consult your legal advisers; we can help gather technical facts.
Who should attend the tabletop exercise?
Usually the owner or CEO, finance, operations, whoever manages communications, and your IT contact. Your insurer's breach coach or legal adviser can also join.
Related services
Products and packages
Industries we support
Service areas
Know what you would do on the worst day
Book a consultation to scope a ransomware readiness review and tabletop exercise for your team.