Plant Ransomware Response Readiness Checklist (Free)

0%

0 of 30 items complete

9 critical items still open - these are the highest-risk gaps.

Download checklist:

Backups and recovery

Backups of ERP, MES and file servers have an offline or immutable copyCRITICALA full restore of the ERP database has been tested in the last 12 monthsCRITICALBackup administration accounts are separate from normal domain admin accountsCRITICALRecovery time and recovery point targets are agreed with operationsBackups of PLC, CNC and robot programs exist and are stored off the machineNetwork device and firewall configurations are backed upInstallation media and licence keys for key systems are stored offline

Prevention and segmentation

Plant networks are separated from corporate IT by a firewall with a default deny policyCRITICALRemote access uses multi factor authentication and a jump hostCRITICALNo OT device is directly reachable from the InternetCRITICALCritical patches on Internet facing systems are applied within a defined deadlineEmail filtering and endpoint protection cover servers as well as laptopsAdmin rights are limited and privileged accounts are reviewed every quarterVendor remote access is time limited, logged and approved

Detection and logging

Logs from firewalls, domain controllers and endpoints go to a central storeCRITICALAlerts for mass file changes or new admin accounts reach a person after hoursSomeone is accountable for monitoring, in house or through a providerAn asset inventory lists servers, OT devices and their ownersBackup failures raise an alert and are reviewed daily

Response plan and roles

A written incident response plan names an incident lead and a backupCRITICALA call tree with phone numbers is stored outside the network, on paper or a phoneDecision authority exists to isolate networks or stop productionContacts for cyber insurance, legal counsel and an incident response firm are on fileCustomer, regulator and law enforcement notification duties are knownA tabletop exercise has been held in the last 12 months

Operations continuity

Manual procedures exist for order entry, receiving, shipping and labellingCRITICALPaper travellers, work instructions and drawings can be printed for key productsPriority systems and the order for restoring them are documentedCritical spare parts and suppliers can be contacted without the ERPOperators know who to call and what to do if HMIs or the MES go dark

Count the items you can honestly mark done. Any unchecked critical item is a priority gap regardless of the total. This checklist is a self assessment, not a certification or a substitute for a professional assessment.

Readiness gap review

Send your unchecked items and get a short, prioritised view. Optional.

Optional. The tool and every export work without this. No spam.

How to use the checklist

Work through the groups with IT, controls, operations and a senior manager in the same room. Tick an item only if you can show evidence, such as a restore report or a signed plan. Export the unchecked list as the starting point of a remediation plan with owners and dates. Repeat twice a year and after major changes.

Be honest, the aim is to find gaps early
Treat critical items first
Attach evidence for the ones you tick
Assign an owner and date to each gap

Why backups and isolation come first

In most ransomware events, the ability to restore without paying depends on whether backups survive the attack. Attackers target backup servers and shares, so an offline or immutable copy, plus separate credentials, is essential. The second factor is isolation: if plant networks are separated from corporate IT, an infection in the office is less likely to stop machines on the floor.

OT and plant specific points

Plant systems often run old operating systems and cannot be patched during production. Compensating controls are segmentation, application allow listing, controlled remote access and tested backups of PLC and CNC programs. Frameworks such as IEC 62443 and NIST guidance for industrial control systems describe these controls, and the checklist maps to their intent without replacing them.

Common mistakes

Teams often assume the backup works, keep the incident plan only on the network that would be encrypted, and forget that the ERP depends on other services such as directory, DNS and licences. Another mistake is no manual fallback: if the ERP is down for days, you still need to ship orders. Practise the manual procedures in an exercise.

Frequently Asked Questions

What is the most important ransomware control?

A tested, offline or immutable backup of key systems, with separate credentials, is the single most valuable control because it lets you recover without paying. Pair it with network segmentation and multi factor authentication on remote access.

How often should I test restores?

Test critical systems at least once a year and after major changes, and test small file level restores more often. A restore test should record how long it took and whether the application worked.

Does this checklist cover OT systems?

Yes, it includes OT backups, segmentation, remote access and manual operations. For a deeper assessment use a framework such as IEC 62443 with a qualified assessor.

Should we pay a ransom?

That is a legal, financial and ethical decision for leadership, counsel, insurers and law enforcement guidance. The aim of this checklist is to make restoration possible so that the question matters less.

Netray works with on-prem and air-gapped setups, which means AI and reporting over your ERP data can run without adding new cloud exposure. Use this checklist first to see where your basics stand.

Talk to an Expert Explore More Free Tools

Related Tools

Developer Tools

More Compliance & Contracts tools

See all

Plant Ransomware Response Readiness Checklist for IT Managers