What should healthcare and other high-pressure organisations do first to reduce ransomware risk during periods of disruption like a pandemic?

The first priority is to reduce the easy entry points attackers exploit when staff are distracted and remote work expands. Teams should harden remote access, keep security software current, and train employees to verify sender identity before opening attachments. They should also maintain reliable backups so recovery does not depend on paying ransom, because resilience matters most when operations are already under strain.

Stop the easiest ransomware entry paths first

In a disruption, attackers usually do not need a novel exploit to get leverage. They look for the simplest path into overloaded environments: exposed remote access, stale endpoints, weak authentication, and user mistakes around email attachments or links. The first move is to reduce those easy entry points before trying to perfect every control.

That means prioritising remote access hardening, patching and endpoint protection, and basic user verification habits over lower-value hardening work. If staff are remote, distracted, or working through unfamiliar workflows, the practical question is whether the organisation can still prevent a simple credential theft, malicious attachment, or unmanaged device from becoming a domain-wide event.

When ransomware spreads during crises, it often succeeds because routine control drift goes unnoticed. Remote access tools, VPNs, and exposed services should be treated as high-risk ingress paths until they are confirmed current, limited, and monitored.

Why resilience matters before recovery pressure rises

Ransomware is not only an encryption problem, it is an operational continuity problem. In healthcare and similar high-pressure settings, downtime hurts twice: it interrupts service delivery and forces rushed decisions under stress. Backups, recovery procedures, and restore testing matter because they preserve the ability to recover without negotiating from a position of desperation.

The real value of backups is not storage, it is recoverability. If backups are incomplete, inaccessible, or never tested under realistic conditions, they do not change the attacker’s leverage. A usable recovery path should cover core systems first, with restore priorities that reflect patient care, business criticality, and acceptable recovery time, not just technical convenience.

During a disruptive event, resilience depends on whether teams can restore systems while normal operations are degraded. That makes backup freshness, offline or isolated copies, and tested restoration more important than theoretical backup coverage.

What “first” means in a real disruption

“First” does not mean “everything at once.” It means reducing the probability of a fast, low-effort compromise while preserving the ability to function if compromise still occurs. The most effective first actions are the ones that shrink the attack surface, interrupt common delivery methods, and preserve recovery options with the least operational friction.

Lock down remote access paths and remove unnecessary exposure.
Confirm endpoint protection, patching, and email filtering are current.
Make sure staff can recognise suspicious attachments and sender impersonation.
Verify that backups are isolated, recent, and actually restorable.

In practice, this is a prioritisation exercise. The organisation should spend early effort on controls that directly reduce the likelihood of initial access and the controls that most quickly preserve recovery if initial access succeeds.

Risk and Threat Considerations

Disruption creates a favourable environment for ransomware because defender attention is fragmented and attackers can exploit both technical exposure and human fatigue. Remote work, emergency process changes, and reduced oversight increase the chance that a single weak point becomes the entry path for a broader intrusion.

Failure mechanism: exposed remote services, stale endpoints, delayed patching, and hurried user behaviour increase the chance of initial compromise, after which ransomware operators can move quickly before teams regain control.

Impact: service interruption, data encryption, and recovery delays become more damaging when the organisation cannot rely on stable operations, making containment and restoration significantly harder.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-8 — Audit Log Management	Ransomware defense depends on visibility into remote access and suspicious activity.
	CIS-12 — Network Infrastructure Management	Hardening remote access and exposed services is a core way to reduce ransomware entry paths.
	CIS-11 — Data Recovery	Backups and tested restores are essential when recovery must work under pressure.
Recommendation — Centralise logs to spot suspicious login and encryption activity early. Restrict and harden remote access services and exposed infrastructure. Validate backups and test restores so recovery does not depend on ransom payment.
NIST CSF 2.0	PR.AA-05 — Identity management, authentication, and access management are integrated into the organization and are managed consistent with the organization's risk strategy	Reducing remote-access abuse and weak entry points depends on strong access management.
	PR.DS-11 — Backups of data are protected from destruction or unauthorized access	Protected backups are central to resilient recovery during ransomware disruption.
	RC.RP-01 — Recovery plan is executed during or after a cybersecurity incident	The question centers on what to do first to restore operations under ransomware pressure.
Recommendation — Enforce strong remote-access authentication and access limits. Protect backup copies so attackers cannot erase recovery options. Practice the recovery plan against ransomware scenarios and restore priorities.
NIST SP 800-53 Rev 5	AC-17 — Remote Access	Remote access is the main ingress path to harden when disruption expands offsite work.
	CP-9 — System Backup	Backups are the key resilience control when ransom payment must be avoidable.
	SI-3 — Malicious Code Protection	Current security software helps block common ransomware delivery and execution.
Recommendation — Tighten remote access methods, scope, and monitoring. Maintain and test backups that can support timely restoration. Keep malware protection current on endpoints and servers.

Practitioner Guidance

What to prioritise: Start with the few controls that most directly narrow initial access and preserve recovery. In a crisis, that usually means remote access review, endpoint hygiene, and backup restoration readiness before broader optimisation work.

What to verify: Do not assume backups are useful because jobs are green. Verify recent restore success for the systems that matter most, and confirm that remote access paths are still limited to approved users and devices.

Practitioner takeaway: The best first move is to remove the attacker’s easiest route in, while ensuring the organisation can still restore critical services if that route is used anyway.