Ransomware Readiness: A 30-Day Checklist for Mid-Sized Companies

Ransomware is not only a problem for large enterprises. Mid-sized companies are attractive targets because they hold valuable data but often lack the resources of a full security operation. The good news is that you can make meaningful progress in 30 days. This checklist breaks the work into weekly priorities.

Week 1: Know your exposure.

• Inventory your critical systems, data, and the people who depend on them.
• Identify internet-facing assets, especially remote access services, and close anything unnecessary.
• Confirm that multifactor authentication is on for email, VPN, remote desktop, and all administrator accounts.
• Review who has administrative privileges and remove excess access.

Week 2: Fix the basics.

• Patch known exploited vulnerabilities on internet-facing systems first, then work inward.
• Make sure endpoint detection and response is deployed on all servers and workstations and is actually reporting.
• Strengthen email filtering and block risky attachment types.
• Disable legacy protocols and unused accounts.

Week 3: Make your backups survive an attack.

• Follow the principle of multiple copies, on different media, with at least one stored offline or immutable.
• Keep backup credentials separate from your main directory so attackers cannot delete them.
• Test a real restoration of a critical system. A backup you have never restored is only a hope.
• Document how long recovery would take and compare it with what the business can tolerate.

Week 4: Prepare to respond.

• Write a concise incident response plan covering who decides, who communicates, and who does the technical work.
• Record contact details for your legal counsel, cyber insurance carrier, and an incident response firm, and keep a printed copy, since your systems may be down.
• Run a short tabletop exercise with leadership. Walk through a scenario in which key systems are encrypted and the attackers demand payment.
• Decide in advance who has authority to make major decisions, including whether to engage law enforcement.

Ongoing habits.

• Train employees to recognize phishing and make reporting suspicious messages easy and blame-free.
• Monitor for unusual activity, or partner with a managed detection provider if you lack round-the-clock coverage.
• Review your cyber insurance requirements, since carriers increasingly expect specific controls.

Measure progress. Track simple indicators: percentage of systems with MFA, patching timelines, successful restore tests, and phishing report rates. Share them with leadership to maintain support.

No checklist makes you immune. But attackers tend to favor the easiest targets, and every control you add raises their cost and lowers your risk. Thirty focused days can move your company from vulnerable to prepared.