How to Prevent Ransomware: A Practical Plan for UK Organisations

How to prevent ransomware comes down to four things: backups an attacker cannot reach, as few ways in as possible, little room to spread once inside, and a response plan you have rehearsed. Assume something will eventually get through, and make sure it cannot stop the business. Many ransomware groups now steal data before they encrypt it and threaten to publish it, so backups alone do not remove the threat; prevention has to cover how attackers get in and how far they get.

This ransomware prevention guide turns the NCSC’s advice into a prioritised checklist, shows which parts Cyber Essentials already covers and which it does not, and explains how to test that your ransomware protection actually works.

How to prevent ransomware: 10 steps in priority order

Work down the list. The first step protects your ability to recover; the next five close the routes attackers use most; the last four limit how far an attacker gets and how fast you respond.

1. Keep a backup attackers cannot reach. Hold at least one copy offline or in immutable storage, with separate admin credentials, and test restores. This is what lets you recover without paying.
2. Patch internet-facing systems first. VPNs, firewalls, remote access gateways and email servers come before everything else, because unpatched edge devices are a common way in.
3. Require MFA on email, cloud services and all remote access, so a stolen or guessed password is no longer enough on its own.
4. Take remote desktop off the internet. Close RDP and admin interfaces to the internet and reach them through a VPN or gateway with MFA. Exposed RDP is a common way in.
5. Remove everyday admin rights. Use separate admin accounts that are never used for email or browsing. This stops malware installing and limits how far it spreads.
6. Stop malicious code running. Run anti-malware or application allow listing on every device, disable autorun and block macros in files from the internet.
7. Harden Active Directory. Set unique local admin passwords, tier your admin accounts and switch legacy protocols off. Domain admin is how one infected laptop becomes every server.
8. Segment the network. Block workstation-to-workstation SMB and RDP to slow lateral movement.
9. Watch for the warning signs. Centralise logs and alert on new admin accounts, backup deletion and security tools being switched off, to catch attackers before they encrypt.
10. Prepare your people and your plan. Train staff, run phishing simulations, and write and rehearse an incident response plan kept offline, so decisions on the day are faster and calmer.

Which of the 10 steps does Cyber Essentials already require?

Cyber Essentials covers the entry points well and the inside of the network hardly at all:

What does the NCSC recommend to stop ransomware?

The NCSC’s guidance on mitigating malware and ransomware attacks is built on defence in depth: no organisation can guarantee prevention, so you put several layers in the way and plan for the one that fails. In plain English it asks for four things:

1. Make backups you can trust. Keep several copies in different places, at least one offline or in a backup service that keeps previous versions, and test restores.
2. Stop malware being delivered and spreading. Filter email and web traffic, lock down remote access with MFA, patch internet-facing devices quickly, and keep admin accounts away from email and browsing.
3. Stop malware running. Manage devices centrally, allow only trusted applications where you can, keep anti-malware updated, restrict scripting and macros, and disable autorun.
4. Prepare for an incident. Know your critical systems, decide in advance how you would respond to a ransom demand, keep plans and contacts offline, and exercise the plan.

What is the best defence against ransomware?

The best single defence is a backup the attacker cannot reach and that you have actually restored. The NCSC warns that ransomware targets backups, so a backup server joined to the same domain, using the same admin passwords, can be encrypted or deleted along with everything else.

Make your backups resilient by:

• Separating them: an offline copy, or immutable storage that cannot be changed or deleted for a set period, even by an administrator.
• Protecting access: separate credentials for the backup console, MFA on a different device, and a backup server that is not joined to your main domain.
• Keeping versions: file sync services such as OneDrive or Dropbox are not backups on their own, because an encrypted file syncs over the good one unless version history is kept.
• Testing restores: restore files regularly and rebuild a whole critical system at least once a year, timing how long it takes.

Backups solve encryption, not extortion. If stolen data is the threat, knowing how to protect against ransomware means stopping attackers getting in and spreading, which the next two sections cover.

Does Cyber Essentials protect against ransomware?

Cyber Essentials closes the routes ransomware most often uses to get in, but it is not a complete ransomware plan. Its five controls map directly onto common entry points:

What it does not cover: backups (recommended in the current requirements but not required), your internal network and Active Directory, logging and detection, and incident response. Cyber Essentials is the right foundation, and Cyber Essentials Plus adds independent testing of a sample of devices, but the inside of the network needs its own work.

How do you stop ransomware spreading across your network?

Limit privilege and harden Active Directory, because an attacker with domain admin rights can push ransomware to every server and laptop at once. The changes that matter most:

• Unique local admin passwords on every machine, managed with Windows LAPS, so one cracked password does not open every device.
• Tiered administration: domain admins never sign in to ordinary workstations, and admin work happens from dedicated, locked-down devices.
• Service accounts with long random passwords or group managed service accounts, so Kerberoasting yields nothing usable.
• Legacy protocols off: SMBv1, LLMNR and NetBIOS name resolution, with SMB signing enforced.
• Host firewalls that block workstation-to-workstation SMB and RDP, and restricted PowerShell for standard users.
• Separate networks for backups and management interfaces.

Our guide to common Active Directory attack paths explains how attackers move from one compromised account to domain admin, and how to close each step.

How do you test your ransomware protection?

Test the assumptions, not just the settings. Each test below answers a different question:

If you are assessed against the full PCI DSS v4.0.1 (a Report on Compliance or SAQ D, for example), requirements 11.4.2 and 11.4.3 already call for internal and external penetration tests at least once every 12 months and after significant changes, and requirement 12.10.2 for testing your incident response plan at least once every 12 months.

Ransomware response plan: what to do if ransomware hits

A ransomware response plan is the part of your incident response plan that sets out these steps in advance. When it happens, follow it: isolate affected devices from the network, preserve evidence, reset credentials from a clean device, and call your cyber insurer and any incident response provider before deciding anything about payment. Report the attack to the NCSC and the police. If personal data has been affected, report it to the ICO within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the people concerned. Check No More Ransom for a free decryptor, and only restore from backups you have scanned and know are clean. Sovereign Secure does not provide incident response or recovery services; our incident response plan template sets out who to notify and how fast, so you can prepare before you need it. Keeping the business trading while systems are rebuilt belongs in your business continuity plan template.

Why Sovereign Secure?

We help you prevent and prepare for ransomware, and prove it. Sovereign Secure Ltd is an IASME-licensed Cyber Essentials certification body, issuing Cyber Essentials and Cyber Essentials Plus certificates. Our penetration testing covers internal networks and Active Directory, external infrastructure, cloud, web applications and social engineering, with vulnerability scanning between tests.

We are ISO 27001 certified ourselves and provide ISO 27001 consultancy, so backup, logging and incident controls can be built into a certified management system, with certification audits carried out by our partner certification body, MQA International. We are also a PCI SSC Qualified Security Assessor (QSA) company and a member of the PCI SSC Global Executive Assessor Roundtable for 2026 to 2028.

Next step

The fastest way to find out whether one compromised laptop could take down your business is an internal penetration test. Request a penetration testing quote or call +44 161 523 5276, and we will scope it around your network and your backups.