Ransomware has evolved from relatively straightforward malware that encrypts files into a sophisticated cybercriminal business ecosystem involving data theft, encryption, extortion, specialized infrastructure, affiliates, access brokers, credential theft, and public leak sites.

Two developments are particularly important for organizations to understand:

1. Double-extortion ransomware, where attackers steal information in addition to encrypting systems.
2. Ransomware-as-a-Service (RaaS), where ransomware capabilities are provided to other criminals through an affiliate-style business model.

These developments mean that having backups alone is no longer a complete ransomware strategy. Organizations must prepare for both operational disruption and potential data breaches.

NIST's current ransomware guidance reflects this broader threat model. Its June 2026 Ransomware Risk Management profile notes that attackers may encrypt organizational data while also stealing information and demanding additional payment to prevent its disclosure. NIST maps ransomware readiness across governance, identification, protection, detection, response, and recovery activities.

What Is Double-Extortion Ransomware?

Double-extortion ransomware combines two forms of pressure against the victim:

Extortion 1 – Encryption

Attackers encrypt systems, files, databases, virtual machines, servers, or network shares and demand money for a decryption mechanism.

Extortion 2 – Data theft

Before or during encryption, attackers copy sensitive information from the victim's environment. They then threaten to publish, sell, or otherwise disclose that information if the ransom is not paid.

The FBI has described double extortion as attacks in which criminals encrypt and steal data and threaten to leak or sell the stolen information.

A simplified attack sequence might look like:

Initial Access → Credential Theft → Privilege Escalation → Network Discovery → Lateral Movement → Data Collection → Data Exfiltration → Backup Disruption → Encryption → Extortion

The exact sequence varies significantly between attacks.

Why Is Double Extortion More Dangerous?

Traditional ransomware created a primarily operational problem:

"Your files are encrypted. Pay us to recover them."

An organization with properly protected and tested backups could potentially refuse payment, rebuild affected systems, and restore its information.

Double extortion changes the equation.

The attackers may effectively say:

"We encrypted your systems, but we also stole your confidential information. Even if you restore everything from backups, we may publish the stolen information."

Therefore:

Backups can solve the recovery problem, but they cannot undo data theft.

This distinction is extremely important.

If attackers successfully exfiltrated information, restoring servers from clean backups does not retrieve or invalidate the copies already possessed by the attackers.

What Information Do Double-Extortion Attackers Target?

Attackers may search compromised environments for high-value information such as:

• Customer databases
• Employee records
• Financial documents
• Tax records
• Payroll information
• Personally identifiable information
• Contracts
• Legal documents
• Intellectual property
• Source code
• Email archives
• Authentication information
• Internal correspondence
• Business plans
• Database backups
• HR documents
• Medical or healthcare information
• Supplier information
• Confidential client files

Attackers may deliberately prioritize information that creates the greatest regulatory, financial, operational, or reputational pressure.

How a Double-Extortion Attack Can Occur

Consider a hypothetical company with:

• 100 Windows workstations
• Several Windows servers
• Microsoft Active Directory
• File servers
• Accounting applications
• Microsoft 365
• Remote-access services
• Cloud and local backups

An attacker obtains access through a compromised employee account or vulnerable remote-access service.

The attacker does not necessarily deploy ransomware immediately.

Instead, the attacker may spend time performing reconnaissance.

Stage 1 – Initial Access

Possible entry mechanisms include:

• Phishing
• Stolen credentials
• Credential stuffing
• Vulnerable VPN appliances
• Internet-facing vulnerabilities
• Compromised remote desktop services
• Malware
• Social engineering
• Supply-chain compromise

Stage 2 – Establish Persistence

Attackers may attempt to ensure continued access by creating accounts, deploying remote-access software, installing malware, modifying scheduled tasks, stealing tokens, or compromising privileged credentials.

Stage 3 – Privilege Escalation

The attacker attempts to obtain administrative or domain-level privileges.

Compromising privileged accounts dramatically increases the potential impact of ransomware.

Stage 4 – Network Discovery

The attacker identifies:

• Servers
• Workstations
• Domain controllers
• Network shares
• Hypervisors
• Databases
• Backup infrastructure
• Security systems
• Cloud services
• Administrative systems

Stage 5 – Lateral Movement

The attacker attempts to move from the initially compromised device into other systems.

Compromised administrator credentials can make this significantly easier.

Stage 6 – Data Collection

High-value information may be copied into staging directories or archives before exfiltration.

Stage 7 – Data Exfiltration

Information may then be transferred to infrastructure controlled by the attackers.

At this stage, the incident is potentially both:

a ransomware incident

and

a data breach.

Stage 8 – Backup Disruption

Sophisticated ransomware operators may attempt to:

• Delete snapshots
• Delete shadow copies
• Disable backup agents
• Compromise backup consoles
• Delete backup repositories
• Encrypt accessible backup storage
• Obtain backup administrator credentials

This is why backup infrastructure should not rely entirely on the same credentials and security boundaries as production infrastructure.

Stage 9 – Ransomware Deployment

Ransomware may then be deployed across multiple endpoints or servers.

Files become encrypted and business operations may stop.

Stage 10 – Extortion

The attackers demand payment for one or more promises, such as:

• Providing a decryptor
• Not publishing stolen information
• Not selling stolen information
• Claiming they will delete stolen information

An organization should never assume that payment proves stolen data has actually been destroyed. The FBI has specifically warned that paying to prevent disclosure does not guarantee the data cannot later be released or used for another extortion attempt.

What Is Ransomware-as-a-Service (RaaS)?

Ransomware-as-a-Service (RaaS) is a cybercriminal operating model in which ransomware developers or operators provide ransomware capabilities and supporting infrastructure to other criminals.

It resembles the legitimate Software-as-a-Service model organizationally, but its purpose is criminal.

Instead of every attacker developing ransomware from scratch, specialized groups can divide the work.

The FBI has noted that ransomware-as-a-service reduces the technical barrier to entering ransomware crime because developers can sell or lease ransomware capabilities to criminal customers.

How the RaaS Ecosystem Works

A RaaS operation may contain several specialized participants.

Ransomware Developers

Developers create and maintain the ransomware code.

Their responsibilities may include:

• Encryption functionality
• Payload development
• Obfuscation
• Evasion techniques
• Infrastructure development
• Updates
• Bug fixes
• Configuration systems

RaaS Operators

Operators manage the broader criminal service.

They may provide:

• Infrastructure
• Affiliate management
• Victim-management systems
• Payment infrastructure
• Negotiation capabilities
• Data-leak infrastructure

Affiliates

Affiliates conduct or participate in intrusions using ransomware provided by the operators.

Depending on the operation, affiliates may handle:

• Initial compromise
• Privilege escalation
• Credential theft
• Lateral movement
• Data theft
• Ransomware deployment

Revenue may then be divided between the affiliate and operator.

Initial Access Brokers

Some cybercriminals specialize in compromising organizations and selling access to other criminals.

For example, they may sell access involving:

• VPN accounts
• RDP credentials
• Administrative credentials
• Web shells
• Compromised endpoints

A ransomware affiliate can therefore potentially purchase existing access instead of conducting the initial compromise itself.

Why RaaS Is a Serious Security Problem

RaaS effectively creates specialization within cybercrime.

One criminal may specialize in malware development.

Another specializes in credential theft.

Another discovers vulnerable internet-facing systems.

Another conducts network intrusion.

Another handles negotiation.

Another launders cryptocurrency.

The result is a cybercriminal supply chain that can allow attackers with different skill levels to participate in ransomware campaigns.

RaaS vs Traditional Ransomware

Traditional Ransomware Model	Ransomware-as-a-Service
Attacker may develop their own malware	Malware may be developed by specialized operators
Single group may conduct most activities	Multiple specialized parties may participate
Higher development requirements	Affiliates can leverage existing ransomware capabilities
Infrastructure must be built by attacker	Infrastructure may be supplied by RaaS operators
Less scalable	Potentially highly scalable
Limited specialization	Cybercriminal roles can be highly specialized

Why Organizations Need a Ransomware Incident-Response Plan

Organizations should assume that preventive controls can sometimes fail.

The question should therefore not only be:

"How do we prevent ransomware?"

It should also be:

"What exactly will we do during the first minutes and hours if ransomware is detected?"

NIST emphasizes that preparation, detection, mitigation, containment, response, and recovery capabilities are important for minimizing the effects of ransomware and other destructive events.

A written ransomware incident-response plan reduces improvisation during a crisis.

Building a Ransomware Incident-Response Plan

1. Define the Incident-Response Team

Determine who has authority during an incident.

The team may include representatives from:

Technical teams

• IT
• Cybersecurity
• Network administration
• Server administration
• Cloud administration
• Backup administrators
• Digital forensics

Management

• Senior management
• Business continuity leadership
• Department heads

Other functions

• Legal counsel
• Privacy/compliance personnel
• Communications/public relations
• Human resources
• Cyber-insurance contacts
• External incident-response providers

Responsibilities and decision-making authority should be documented before an attack occurs.

2. Maintain an Emergency Contact List

The organization should maintain contact information for critical parties such as:

• Incident-response personnel
• Senior management
• Legal counsel
• Cyber-insurance provider
• Managed service provider
• Backup provider
• Cloud provider
• Security vendors
• Internet service provider
• External forensic specialists
• Relevant law-enforcement contacts

Keep an offline copy.

If Active Directory, email, file servers, or cloud accounts become unavailable, an emergency contact list stored only on those systems may be inaccessible.

3. Establish Out-of-Band Communication

Attackers may have compromised corporate email, collaboration systems, or administrative accounts.

The response plan should therefore specify alternative communication methods.

CISA specifically recommends considering out-of-band communication during ransomware response because malicious actors may be monitoring normal organizational communications.

4. Identify Critical Assets

Maintain an accurate inventory covering:

• Domain controllers
• File servers
• Database servers
• Application servers
• Hypervisors
• Virtual machines
• Cloud resources
• Network devices
• Backup servers
• NAS devices
• Employee endpoints
• Remote-access systems
• Business-critical applications

Classify systems by business criticality.

This information becomes extremely important when determining restoration priorities.

5. Define Immediate Containment Procedures

One of the first priorities during active ransomware is preventing further propagation.

CISA's ransomware response checklist recommends identifying affected systems and immediately isolating them. Where many systems or subnets are affected, broader network isolation may be necessary.

Possible containment actions include:

• Disconnect affected computers from Ethernet.
• Disable Wi-Fi on compromised endpoints.
• Isolate affected network segments.
• Disable compromised accounts.
• Restrict suspicious remote access.
• Block known malicious indicators.
• Protect backup infrastructure.
• Restrict unnecessary server-to-server communication.

However, containment should be coordinated carefully.

Turning systems off indiscriminately can destroy volatile forensic evidence and complicate investigation.

6. Protect Backups Immediately

Backup systems are among the most important assets during ransomware response.

Organizations should determine:

• Whether backup repositories were accessed
• Whether backup credentials were compromised
• Whether backup jobs were modified
• Whether snapshots were deleted
• Whether backup files were encrypted
• Whether cloud backups were affected
• Whether immutable recovery points remain available

Potentially clean recovery copies should be protected from further modification.

7. Preserve Evidence

Ransomware is also a forensic investigation.

Evidence may include:

• Security logs
• Firewall logs
• VPN logs
• Authentication logs
• Windows Event Logs
• EDR telemetry
• SIEM records
• Email records
• Ransom notes
• Malware samples
• Suspicious executables
• Network captures
• Cloud audit logs
• Backup logs

Evidence preservation can help determine:

How did the attackers enter?

Which accounts were compromised?

How long were they present?

What systems were accessed?

Was information stolen?

Is the attacker still inside the environment?

8. Determine the Scope of Compromise

Do not assume that the first encrypted computer is the beginning of the attack.

Encryption may be the final visible stage of an intrusion that started days or weeks earlier.

Investigators should determine:

• Initial access vector
• Patient-zero system where possible
• Compromised accounts
• Privilege escalation
• Persistence mechanisms
• Lateral movement
• Affected systems
• Data accessed
• Data potentially exfiltrated
• Backup compromise
• Cloud compromise

9. Investigate Data Exfiltration

This step is essential in double-extortion incidents.

Look for indicators such as:

• Large outbound transfers
• Unusual cloud-storage traffic
• Large archive files
• Unexpected compression utilities
• Abnormal database exports
• Transfers from file servers
• Unusual traffic outside business hours

The organization may need to determine whether the incident creates legal or regulatory breach-notification obligations.

10. Reset Compromised Credentials

Once containment is coordinated, compromised credentials should be revoked or changed.

Potential targets include:

• Domain administrator accounts
• Local administrator passwords
• Service accounts
• Backup administrator accounts
• VPN accounts
• Cloud administrator accounts
• Microsoft 365 accounts
• API credentials
• Application credentials

Where supported, revoke active sessions and authentication tokens as well.

Simply changing one user's password may be insufficient if attackers have obtained privileged credentials or established persistence elsewhere.

11. Eradicate the Attackers

Before restoring production systems, organizations need reasonable confidence that attacker persistence has been removed.

This can involve:

• Removing malware
• Removing unauthorized accounts
• Removing persistence mechanisms
• Closing exploited vulnerabilities
• Patching systems
• Reconfiguring remote access
• Replacing compromised credentials
• Rebuilding heavily compromised systems
• Revalidating Active Directory
• Reviewing cloud accounts
• Rechecking endpoints with EDR

For highly compromised systems, rebuilding from a known-good baseline may be safer than trying to manually clean every malicious artifact.

12. Restore Systems in Priority Order

Recovery should follow predefined business priorities.

A hypothetical sequence could be:

Tier 0

Identity and authentication infrastructure

Tier 1

Networking, DNS, DHCP, security and core infrastructure

Tier 2

Critical databases and application servers

Tier 3

File servers and departmental applications

Tier 4

User endpoints and lower-priority systems

The correct order depends on the organization's architecture.

13. Do Not Restore Without Verifying Backups

A backup existing does not automatically mean it is safe.

Before restoration, verify:

• Backup integrity
• Recovery-point date
• Malware contamination
• Ransomware encryption
• Backup configuration
• Required application dependencies

Organizations should regularly test restoration procedures before an incident rather than discovering backup problems during an emergency.

14. Monitor Recovered Systems

Recovery is not complete simply because servers are operational again.

Closely monitor:

• Authentication events
• Administrative accounts
• Network connections
• EDR alerts
• DNS activity
• Firewall activity
• Cloud sign-ins
• Scheduled tasks
• Newly created accounts
• Remote-access activity

Attackers may have left additional persistence mechanisms.

15. Prepare for the Data-Breach Component

In double-extortion ransomware, technical restoration is only part of the incident.

The organization may also need to investigate:

• What information was stolen
• Whose information was involved
• Applicable privacy regulations
• Contractual notification requirements
• Customer notification requirements
• Regulatory reporting
• Law-enforcement reporting
• Cyber-insurance requirements

Legal counsel and appropriate privacy/compliance professionals should be involved in these decisions.

16. Create a Ransomware Decision Matrix

Important decisions should be discussed before an actual attack.

For example:

Question	Responsible Party
Who declares a ransomware incident?	Incident Response Lead
Who can isolate major network segments?	IT/Security Lead
Who contacts cyber insurance?	Management/Legal
Who contacts external forensic investigators?	Incident Response Lead
Who communicates with customers?	Management/Communications
Who approves system restoration?	IT + Business Owner
Who determines breach-notification obligations?	Legal/Compliance
Who communicates with law enforcement?	Management/Legal

This prevents uncertainty when every minute matters.

17. Conduct Ransomware Tabletop Exercises

A plan that has never been tested may fail during a real incident.

Organizations should conduct periodic tabletop exercises.

For example:

"It is Monday at 9:15 AM. Employees report that shared files have strange extensions. Multiple servers become inaccessible. A ransom note appears stating that 500 GB of company information has been stolen. What do you do?"

Participants then walk through the incident.

Questions should include:

• Who is contacted first?
• Who has authority to isolate the network?
• Can backups be accessed?
• Are backup credentials independent?
• How will employees communicate?
• How will remote users be disconnected?
• Who contacts insurance?
• Who handles forensic investigation?
• How will customers be informed if necessary?
• Which systems are restored first?

Tabletop exercises frequently reveal gaps that ordinary documentation reviews miss.

Technical Controls That Support Ransomware Response

A strong incident-response plan should be supported by technical controls.

Endpoint Detection and Response

EDR can help detect suspicious activities such as:

• Credential dumping
• Malware execution
• Suspicious PowerShell
• Privilege escalation
• Lateral movement
• Mass file modification

SIEM and Centralized Logging

Centralized logs help reconstruct attacker activity even when individual machines become unavailable.

Network Segmentation

Separating endpoints, servers, backups, administrative systems, and critical workloads can limit lateral movement.

Multifactor Authentication

MFA should be implemented especially for:

• VPN
• Remote administration
• Cloud administration
• Email
• Privileged accounts
• Backup administration

Privileged Access Management

Administrative accounts should not routinely be used for ordinary email, web browsing, or daily office work.

Backup Isolation

Consider maintaining multiple recovery layers, including appropriately designed:

• Online backups
• Offline backups
• Immutable backups
• Off-site copies

Administrative access to backups should also be strongly protected.

A Practical Ransomware Response Workflow

Organizations can structure their ransomware playbook around the following sequence:

DETECT

Identify ransomware, suspicious encryption, unusual authentication, malware, or exfiltration.

↓

CONTAIN

Isolate affected endpoints, accounts, servers, and network segments.

↓

PROTECT RECOVERY ASSETS

Secure backups and unaffected systems.

↓

PRESERVE EVIDENCE

Collect logs, ransom notes, malware samples, telemetry, and forensic information.

↓

INVESTIGATE

Determine initial access, compromised credentials, lateral movement, persistence, affected systems, and possible data theft.

↓

ERADICATE

Remove attacker access and close the original entry point.

↓

RECOVER

Restore verified systems and information from trusted recovery points.

↓

MONITOR

Watch carefully for persistence and renewed malicious activity.

↓

REVIEW

Document lessons learned and strengthen security controls.

NIST's latest ransomware profile aligns ransomware resilience with the broader CSF 2.0 functions of Govern, Identify, Protect, Detect, Respond, and Recover, making ransomware preparation an organization-wide risk-management responsibility rather than merely an IT backup problem.

Common Ransomware Incident-Response Mistakes

Organizations should avoid several common mistakes.

Mistake 1: Assuming backups mean ransomware is solved

Backups help recovery but cannot reverse stolen-data exposure.

Mistake 2: Reconnecting systems too quickly

A restored machine can become compromised again if attacker persistence remains.

Mistake 3: Destroying forensic evidence

Indiscriminately wiping systems before investigation can make it difficult to determine the initial entry point and scope.

Mistake 4: Leaving backups connected with production-level credentials

Attackers may deliberately target backup infrastructure.

Mistake 5: Changing only one compromised password

A sophisticated attacker may have multiple credentials, tokens, service accounts, persistence mechanisms, or administrator accounts.

Mistake 6: Treating encryption as the beginning of the attack

Encryption may actually be one of the final stages.

Mistake 7: Failing to test the incident-response plan

An untested plan may contain incorrect phone numbers, unavailable recovery procedures, unclear authority, or inaccessible documentation.

Ransomware Preparation Checklist

Organizations should be able to answer YES to as many of these questions as possible:

• Do we maintain an updated asset inventory?
• Do we know which systems are business-critical?
• Do we maintain offline or appropriately isolated backups?
• Do we maintain immutable recovery points where practical?
• Are backups protected with separate administrative controls?
• Do we regularly test restoration?
• Is MFA enabled for critical remote and administrative access?
• Are privileged accounts separated from normal user accounts?
• Do we centrally collect security logs?
• Do we have endpoint monitoring or EDR?
• Is our network appropriately segmented?
• Do we have a documented ransomware response plan?
• Do we maintain an offline copy of that plan?
• Do we have emergency communication procedures?
• Do we know whom to contact for forensic assistance?
• Do we know how to contact our cyber-insurance provider?
• Do we know who has authority to isolate systems?
• Do we have a process for investigating data exfiltration?
• Do we periodically conduct ransomware tabletop exercises?
• Do we have documented recovery priorities?

Frequently Asked Questions (FAQ)

1. What is double-extortion ransomware?

Double-extortion ransomware is an attack in which cybercriminals may both encrypt systems and steal information, then use the threat of disclosure or sale of that information as additional leverage.

2. Is double extortion different from ordinary ransomware?

Yes. Traditional ransomware primarily focuses on preventing access to information through encryption. Double extortion adds data theft and the threat of disclosure.

3. Can backups protect against double-extortion ransomware?

Backups can significantly improve the organization's ability to recover encrypted or destroyed information, but they cannot reverse information that attackers have already stolen.

4. What is ransomware-as-a-service?

Ransomware-as-a-Service is a criminal model where ransomware developers or operators provide ransomware tools and infrastructure to other criminals or affiliates.

5. Does a RaaS affiliate need to develop ransomware?

Not necessarily. One attraction of RaaS for criminals is that the ransomware platform may already be developed and maintained by an operator.

6. Why has RaaS increased the ransomware threat?

It lowers some technical barriers to ransomware operations and enables specialization between malware developers, operators, affiliates, access brokers, and other criminal services.

7. What should an organization do first when ransomware is discovered?

Identify affected systems and begin coordinated isolation to prevent further propagation. CISA's response guidance specifically prioritizes determining which systems are affected and immediately isolating them.

8. Should an infected computer be disconnected from the network?

Generally, network isolation is an important containment action. However, incident responders should coordinate actions carefully because shutting down or altering systems can affect forensic evidence.

9. Should organizations immediately format infected computers?

Usually not before appropriate evidence and forensic information have been preserved. Investigation may be necessary to determine how attackers entered and what they accessed.

10. Can ransomware infect backups?

Backups that are accessible from compromised production systems or administrative accounts can potentially be deleted, modified, or encrypted. Backup isolation and strong administrative separation are therefore important.

11. What are immutable backups?

Immutable backups are recovery copies designed so they cannot be modified or deleted during a defined retention period, including by many forms of compromised administrative access.

12. Why are offline backups useful?

Offline backups are not continuously reachable from production systems, reducing the opportunity for ransomware to attack them directly.

13. How often should organizations test ransomware recovery?

Testing should occur periodically and after significant infrastructure, application, backup, or network changes. Critical systems generally justify more frequent recovery validation.

14. What is a ransomware tabletop exercise?

It is a simulated ransomware scenario in which technical teams, management, legal personnel, communications staff, and other stakeholders walk through how they would respond to a hypothetical incident.

15. Is ransomware only an IT department problem?

No. Modern ransomware can involve business continuity, financial losses, privacy obligations, legal issues, customer communication, regulatory reporting, insurance, and reputation.

16. Does paying guarantee stolen information will be deleted?

No. An organization has no reliable technical mechanism to prove that every copy controlled by criminals has actually been destroyed. The FBI has warned that information obtained by attackers could potentially be released or used for future extortion even after payment.

17. Why should organizations preserve logs during ransomware incidents?

Logs can help investigators reconstruct the attack, determine the initial access method, identify compromised accounts, trace lateral movement, assess possible data theft, and understand the scope of compromise.

18. Should ransomware response include data-breach procedures?

Yes. Because modern ransomware frequently involves data theft, organizations should be prepared to investigate whether sensitive information was accessed or exfiltrated and determine applicable legal, contractual, and regulatory obligations.

19. What framework can organizations use for ransomware preparedness?

The NIST Cybersecurity Framework 2.0 and NIST IR 8374 Rev. 1 provide a useful structure for ransomware risk management across Govern, Identify, Protect, Detect, Respond, and Recover. The current revision was finalized in June 2026.

20. What is the most important principle of ransomware preparedness?

Prepare for both system recovery and data compromise.

Modern ransomware planning should assume that attackers may attempt to:

steal data + compromise credentials + attack backups + encrypt systems + extort the organization.

A mature ransomware program therefore combines prevention, detection, containment, forensic investigation, protected backups, recovery testing, business continuity, legal preparation, and incident-response exercises.

#Tags

#Ransomware #DoubleExtortion #DoubleExtortionRansomware #RansomwareAsAService #RaaS #CyberSecurity #CyberAttack #CyberThreat #CyberCrime #Malware #DataExtortion #DataExfiltration #DataBreach #RansomwareAttack #RansomwareProtection #RansomwarePrevention #RansomwareResponse #IncidentResponse #IncidentResponsePlan #CyberIncidentResponse #RansomwareRecovery #DisasterRecovery #BusinessContinuity #DataBackup #ImmutableBackup #OfflineBackup #BackupSecurity #CyberResilience #EndpointSecurity #EDR #XDR #SIEM #NetworkSecurity #NetworkSegmentation #ZeroTrust #MFA #MultiFactorAuthentication #PrivilegedAccess #ActiveDirectorySecurity #ThreatDetection #ThreatHunting #DigitalForensics #CyberForensics #SecurityMonitoring #VulnerabilityManagement #PatchManagement #CyberInsurance #NIST #CISA #StopRansomware