Reviewed and updated on 20 October 2026.
A ransomware incident can lock staff out of systems and expose confidential information. Your IT provider should be able to explain how it reduces the risk, detects suspicious activity and supports recovery. A list of security products is not enough.
Ask about the work behind the tools
- Updates: who tracks unsupported software, applies security fixes and follows up failed installations?
- Access: how are administrator accounts, remote connections and staff permissions protected?
- Monitoring: who reviews alerts, at what hours, and how are urgent incidents escalated?
- Staff reporting: can employees quickly report a suspicious message or unexpected prompt?
Check that recovery is possible
Attackers may target backups as well as live systems. Ask how backup access and recovery copies are protected, when restores were last tested and which business services would return first. The NCSC’s backup principles provide questions to use with your supplier.
A backup completion email does not show how long recovery will take. A useful test records the data restored, dependencies, elapsed time and checks made by the people who use the system.
Agree the response before an incident
Keep a response plan available when normal email and file systems cannot be used. Name the decision-maker, technical response lead, supplier contacts and people responsible for communications. Confirm what your support agreement includes and what requires a separate incident response service.
Paying a ransom is not a guaranteed route to recovery. The NCSC and UK law enforcement do not endorse ransom payments. If an incident occurs, activate your response plan and seek specialist help to contain it and assess recovery options.
CIS can review your backup and recovery arrangements alongside managed IT support.
