# Plant Ransomware Response Readiness Checklist for IT Managers > Source: https://netray.co/tools/plant-ransomware-response-readiness-checklist > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer A practical checklist to test whether your plant can detect, contain and recover from ransomware across IT, ERP and OT. ## Category compliance-legal ## Audience - IT manager - CISO - OT security engineer - Plant manager ## Tool **Kind:** checklist **Groups:** #### Backups and recovery **Items:** **Text:** Backups of ERP, MES and file servers have an offline or immutable copy **Critical:** true **Text:** A full restore of the ERP database has been tested in the last 12 months **Critical:** true **Text:** Backup administration accounts are separate from normal domain admin accounts **Critical:** true Recovery time and recovery point targets are agreed with operations Backups of PLC, CNC and robot programs exist and are stored off the machine Network device and firewall configurations are backed up Installation media and licence keys for key systems are stored offline #### Prevention and segmentation **Items:** **Text:** Plant networks are separated from corporate IT by a firewall with a default deny policy **Critical:** true **Text:** Remote access uses multi factor authentication and a jump host **Critical:** true **Text:** No OT device is directly reachable from the Internet **Critical:** true Critical patches on Internet facing systems are applied within a defined deadline Email filtering and endpoint protection cover servers as well as laptops Admin rights are limited and privileged accounts are reviewed every quarter Vendor remote access is time limited, logged and approved #### Detection and logging **Items:** **Text:** Logs from firewalls, domain controllers and endpoints go to a central store **Critical:** true Alerts for mass file changes or new admin accounts reach a person after hours Someone is accountable for monitoring, in house or through a provider An asset inventory lists servers, OT devices and their owners Backup failures raise an alert and are reviewed daily #### Response plan and roles **Items:** **Text:** A written incident response plan names an incident lead and a backup **Critical:** true A call tree with phone numbers is stored outside the network, on paper or a phone Decision authority exists to isolate networks or stop production Contacts for cyber insurance, legal counsel and an incident response firm are on file Customer, regulator and law enforcement notification duties are known A tabletop exercise has been held in the last 12 months #### Operations continuity **Items:** **Text:** Manual procedures exist for order entry, receiving, shipping and labelling **Critical:** true Paper travellers, work instructions and drawings can be printed for key products Priority systems and the order for restoring them are documented Critical spare parts and suppliers can be contacted without the ERP Operators know who to call and what to do if HMIs or the MES go dark **Scoring Note:** Count the items you can honestly mark done. Any unchecked critical item is a priority gap regardless of the total. This checklist is a self assessment, not a certification or a substitute for a professional assessment. ## Content **Intro:** Manufacturers are attractive ransomware targets because downtime is expensive and plants are often hard to patch. This checklist shows quickly whether you could recover and keep shipping if systems were encrypted tomorrow. **Sections:** #### How to use the checklist **Body:** Work through the groups with IT, controls, operations and a senior manager in the same room. Tick an item only if you can show evidence, such as a restore report or a signed plan. Export the unchecked list as the starting point of a remediation plan with owners and dates. Repeat twice a year and after major changes. **Bullets:** - Be honest, the aim is to find gaps early - Treat critical items first - Attach evidence for the ones you tick - Assign an owner and date to each gap #### Why backups and isolation come first **Body:** In most ransomware events, the ability to restore without paying depends on whether backups survive the attack. Attackers target backup servers and shares, so an offline or immutable copy, plus separate credentials, is essential. The second factor is isolation: if plant networks are separated from corporate IT, an infection in the office is less likely to stop machines on the floor. #### OT and plant specific points **Body:** Plant systems often run old operating systems and cannot be patched during production. Compensating controls are segmentation, application allow listing, controlled remote access and tested backups of PLC and CNC programs. Frameworks such as IEC 62443 and NIST guidance for industrial control systems describe these controls, and the checklist maps to their intent without replacing them. #### Common mistakes **Body:** Teams often assume the backup works, keep the incident plan only on the network that would be encrypted, and forget that the ERP depends on other services such as directory, DNS and licences. Another mistake is no manual fallback: if the ERP is down for days, you still need to ship orders. Practise the manual procedures in an exercise. **Cta:** Netray works with on-prem and air-gapped setups, which means AI and reporting over your ERP data can run without adding new cloud exposure. Use this checklist first to see where your basics stand. **Faq:** #### What is the most important ransomware control? **Answer:** A tested, offline or immutable backup of key systems, with separate credentials, is the single most valuable control because it lets you recover without paying. Pair it with network segmentation and multi factor authentication on remote access. #### How often should I test restores? **Answer:** Test critical systems at least once a year and after major changes, and test small file level restores more often. A restore test should record how long it took and whether the application worked. #### Does this checklist cover OT systems? **Answer:** Yes, it includes OT backups, segmentation, remote access and manual operations. For a deeper assessment use a framework such as IEC 62443 with a qualified assessor. #### Should we pay a ransom? **Answer:** That is a legal, financial and ethical decision for leadership, counsel, insurers and law enforcement guidance. The aim of this checklist is to make restoration possible so that the question matters less. ## Search terms ransomware readiness checklist, manufacturing ransomware plan, ot ransomware response checklist, incident response checklist plant, ransomware recovery checklist, offline backup checklist, cyber incident plan manufacturing, erp ransomware recovery --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json