Why boards must own this
Modern ransomware operations steal data before encrypting it, then use the threat of publication as leverage. That turns an outage into a legal, regulatory and reputational event. Decisions about shutting down systems, engaging negotiators or notifying regulators cannot wait for a board meeting to be convened.
The questions a board should ask
- If our main data centre and cloud tenant were encrypted tonight, how long until we could serve customers again? Has that been tested?
- Are our backups immutable and isolated from the identities attackers would compromise?
- Who is authorised to take systems offline, and who decides on engaging external responders?
- How quickly can we meet CERT-In, sectoral regulator and DPDP notification obligations?
- What does our cyber insurance actually cover, and what are its conditions?
Controls that make the biggest difference
Identity first
Most ransomware incidents involve compromised credentials. Prioritise:
- Phishing-resistant MFA for administrators and remote access
- Removing standing domain admin rights
- Monitoring for unusual privilege use
Backups that survive the attack
- Follow the 3-2-1 principle with at least one immutable or offline copy
- Separate backup administration credentials from the production directory
- Test restores of critical systems, not just individual files
Detection and containment
- Endpoint detection and response on servers as well as laptops
- Alerts on mass file changes, backup deletion attempts and shadow copy removal
- The ability to isolate hosts and network segments quickly
Exposure reduction
- Patch internet-facing systems — VPNs, firewalls, file-transfer tools — on an accelerated timeline
- Close remote desktop exposure to the internet
Rehearse the decisions
Run an executive tabletop once a year. Include legal, communications and the business, and time how long key decisions take. Most organisations discover their real gap is decision-making, not technology.
The board checklist
- [ ] Recovery time objectives agreed and tested for critical services
- [ ] Immutable backups verified by a restore test this year
- [ ] MFA on all privileged and remote access
- [ ] Incident response retainer in place
- [ ] Regulatory notification playbook rehearsed
- [ ] Executive tabletop completed with actions tracked
Key takeaways
- Ransomware is a business-continuity and legal event, not only an IT incident.
- Identity hardening and immutable, tested backups give the biggest risk reduction.
- Rehearse executive decisions before you need them.
Frequently asked questions
Should we pay a ransom?
It is a business, legal and ethical decision that should be made in advance with legal counsel, considering sanctions, insurance terms and the realistic chance of recovery without paying.
Are cloud backups enough?
Only if attackers who compromise your environment cannot delete or encrypt them. Use immutability or isolation and separate credentials for backup administration.
How often should we test recovery?
At least annually for critical services, and after major changes. Measure the actual time to restore against your recovery objectives.
The best time to decide whether you would pay a ransom is before you are asked.
Our cyber security services include ransomware readiness assessments and executive tabletop exercises.
