Ransomware
Malicious software that encrypts or steals an organization's data and demands payment to restore access or prevent publication.
A ransomware incident can stop operations for days, expose client data and trigger notification duties, so backup design, access controls and response planning are business continuity decisions, not only IT tasks.
An agency keeps nightly encrypted backups in an immutable offline store, enforces phishing-resistant MFA on email and VPN, and runs a quarterly drill restoring its CRM and file server within a 4-hour recovery target.
Paying does not guarantee working decryption or deletion of stolen data and can raise legal and sanctions issues. Backups alone do not address double extortion, where attackers threaten to publish stolen data even after systems are restored.
Attacks usually begin with Phishing, stolen credentials or an unpatched internet-facing system, followed by privilege escalation, lateral movement, data theft and deletion of reachable backups before encryption starts. Double extortion combines encryption with a threat to leak data. CISA's #StopRansomware Guide covers prevention and an Incident Response checklist, NIST IR 8374 Rev. 1 maps ransomware risk to the CSF 2.0 functions, and Vulnerability Management closes common entry points.
Systems Architecture
CISA — #StopRansomware Guide — https://www.cisa.gov/stopransomware/ransomware-guide; NIST — IR 8374 Rev. 1 Ransomware Risk Management: A Cybersecurity Framework 2.0 Community Profile — https://csrc.nist.gov/pubs/ir/8374/r1/final