Ransomware readiness checklist

Why run this

What this checklist is for

In most sectors a recovery time objective is a commercial decision. In healthcare it is a clinical one, and that changes both the number and who sets it.

The question is not how long until systems are restored. It is how long the organization can deliver safe care without them, and whether anybody has tested that assumption at scale.

Run it with

CIO and Chief Medical or Nursing Officer jointly

And with

Security and infrastructure teams

And with

Clinical operations leadership

The checklist

20 checks, in the order we would run them

Tick only what you can genuinely evidence today. An item you intend to do is not an item you have done, and scoring yourself generously here only produces a comfortable number and an uncomfortable project.

Section 1

Clinical continuity

The section that should set every technical target below it.

Downtime procedures exist and have been rehearsed in the last twelve monthsMost were written years ago and few have been tested at the scale a real event would require.
Clinical leadership has stated how long safe care can continue on paperThat number sets your recovery objective. IT should be told it, not choose it.
A restoration sequence is agreed clinically, in advanceNot everything restores at once. Deciding the order during an incident wastes the hours that matter most.
Downtime forms and paper processes are physically available on every wardStored on a network share is not available during the event they exist for.
Staff know where downtime procedures are and have used themAwareness is not the same as familiarity. A rehearsal establishes which one you have.

Section 2

Prevention

The controls that close the paths intrusions actually take.

Multi-factor authentication on every account including service and admin accountsService accounts are the common exception and the common entry point.
Network segmentation between clinical, corporate and medical device estatesHealthcare networks are frequently flat for historical reasons. This limits blast radius more than any detection control.
Medical devices and unpatched systems identified and compensated forSome cannot be patched or onboarded. Record them as accepted risk with a compensating control rather than leaving them off the diagram.
Privileged access separated from daily accounts with just-in-time elevationStraightforward to establish before people accumulate standing permissions, considerably harder afterwards.
Endpoint coverage reconciled against the physical device inventoryCompare against inventory, not against expectation. The gap is usually real and usually surprising.

Section 3

Detection and response

The variable with the largest effect on total impact.

Signal correlated across endpoint, identity, email and cloud into single incidentsFour alerts in four consoles is a fragment. One correlated incident is a case somebody can work.
Alert volume is at a level your team genuinely works throughAn untuned console is functionally the same as no detection, and it is a tuning problem rather than a staffing one.
Somebody is authorised to isolate a device at 3am without seeking approvalContainment at ticket speed while lateral movement runs at machine speed is not containment.
Automated response boundaries agreed for clinical-adjacent systemsAn automated isolation of the wrong host during a shift is a clinical event. Agree the boundary in writing.
Out-of-hours coverage is staffed rather than on-callThe practical test is what happens at 3am on a Sunday. Somebody at a desk responds differently from somebody woken up.

Section 4

Recovery

What determines whether a bad week becomes a bad quarter.

Backups are immutable and unreachable from the production domainA backup an attacker can encrypt is not a backup.
A full-scale restore has been rehearsed, not merely tested in partAn untested recovery objective is a hypothesis. The rehearsal always finds a dependency nobody mapped.
Identity restoration is first in the sequence and has been practisedNothing else can be restored until people can authenticate. This is routinely underestimated.
A communications plan exists for patients, staff and regulatorsIncluding who speaks, to whom, and within what timeframe your obligations require.
Cyber insurance notification requirements are known and reachable out of hoursPolicies carry notification windows. Missing one during the worst week of your year is an avoidable second problem.

What your score means

Read this against the number above

These bands are deliberately blunt. The middle band is where most organizations honestly sit, and it is a perfectly reasonable place to proceed from — provided the gaps are written down with owners rather than carried as optimism.

0–59%Significant gaps

Do not proceed yet. More than four in ten items are unaddressed, and the ones that fail here are usually the foundational ones that make everything after them harder.

60–84%Mostly ready, with known gaps

Proceed on a defined scope, with the outstanding items written into the plan as risks with owners and dates. This is the most common honest position.

85–100%Ready

The remaining gaps are small enough to handle during delivery rather than before it. Confirm the unticked items are genuinely minor rather than simply unexamined.

Your score highlights automatically as you tick items above. Nothing is saved, sent or tracked — refreshing the page clears it.

Closing the gaps

If you could not tick these, start here

The four items below are the ones whose absence causes the most trouble downstream. If your unticked items include any of these, they are worth addressing before the rest.

Downtime procedures never rehearsed

Schedule one this quarter with clinical leadership present. Every provider that does this properly finds something significant.

Flat network

Segmentation is the highest-value control available to you and does not require touching equipment that cannot be touched.

Backups never restored at full scale

Rehearse it. Finding the broken dependency on a planned Saturday costs a weekend.

Recovery objective set by IT

Get the number from clinical leadership. A technically achievable target that does not match clinical tolerance is the wrong target.

Want a second opinion on your score?

We run a coverage and recovery assessment across the estate and facilitate the rehearsal with your clinical and IT leadership together, which is the part that produces the useful findings.

Talk through your result Read the related guides We reply to every message within one business day.

Keep going

Related checklists

sharepoint

healthcareReadiness

Copilot readiness checklist

Twenty checks to run before assigning a single Microsoft 365 Copilot licence in a healthcare organization.

July 25, 2026 · 20 checksOpen

azure

healthcareReadiness

Cloud workload security review

Twenty checks on an Azure workload holding patient data, covering network, identity, keys and the evidence an auditor will ask for.

May 2, 2026 · 20 checksOpen

What this checklist is for

Run it with

And with

And with

20 checks, in the order we would run them

Clinical continuity

Prevention

Detection and response

Recovery

Read this against the number above

If you could not tick these, start here

Downtime procedures never rehearsed

Flat network

Backups never restored at full scale

Recovery objective set by IT

Want a second opinion on your score?

Related checklists

Copilot readiness checklist

Cloud workload security review

Tell us what you're trying to fix

Let’s get started on something great

Phone

Email