Safeguard Against Ransomware
We recommend the following steps to safeguard against Ransomware:
- Back up systems—now (and daily). Immediately and regularly back up all critical agency and system configuration information on a separate device and store the backups offline, verifying their integrity and restoration process. Backup your files to the cloud using an online backup service.
- Reinforce basic cybersecurity awareness and education. Ransomware attacks often require the human element to succeed. Refresh employee training on recognizing cyber threats, phishing, and suspicious links—the most common vectors for ransomware attacks. Remind employees of how to report incidents to appropriate IT staff in a timely manner, which should include out-of-band communication paths.
- Revisit and refine cyber incident response plans. Have a clear plan to address attacks when they occur, including when internal capabilities are overwhelmed. Make sure response plans include how to request assistance from external cyber first responders, such as state agencies, CISA, and MS-ISAC, in the event of an attack.
CISA encourages organizations to review the Joint Ransomware Statement and the following ransomware guidance:
- MS-ISAC Security Primer on Ransomware
- CISA Tip Sheet on Ransomware
- NGA Disruption Response Planning Memo
- NASCIO Cyber Disruption Planning Guide