Ransomware has become the single most destructive cyber threat facing UK businesses. These attacks encrypt an organisation's files and demand payment — often in cryptocurrency — for the decryption key. The damage goes far beyond the ransom itself: business downtime, data loss, regulatory penalties, and reputational harm can be catastrophic. Cyber Essentials Plus provides a verified defence framework that directly addresses the most common ransomware attack vectors, significantly reducing your organisation's risk.
This guide explains how each of the five CE+ technical controls helps protect against ransomware, backed by real-world evidence of their effectiveness.
The Ransomware Crisis in Numbers
The NCSC has consistently stated that Cyber Essentials controls, when properly implemented, protect against the vast majority of common cyber attacks — and ransomware is no exception. The scheme was specifically designed to address the techniques that attackers use most frequently.
How Ransomware Gets In
Understanding how ransomware enters an organisation is the key to understanding how CE+ stops it. The most common attack vectors are:
Every single major ransomware attack vector is addressed by one or more of the five Cyber Essentials Plus controls. Let us examine each control in detail.
Control 1: Firewalls — Blocking the Entry Points
Firewalls are your first line of defence against ransomware. They control what traffic can enter and leave your network, preventing attackers from reaching vulnerable systems.
How firewalls protect against ransomware:
- Block unauthorised inbound connections that attackers use to reach exposed services
- Prevent RDP exposure — exposed Remote Desktop Protocol is a favourite entry point for ransomware gangs
- Restrict outbound traffic to prevent ransomware from communicating with command-and-control servers
- Network segmentation limits the spread of ransomware if it does get in
Control 2: Secure Configuration — Reducing the Attack Surface
Secure configuration reduces the number of ways ransomware can gain a foothold on your systems. By removing unnecessary software, disabling unneeded services, and configuring systems securely, you eliminate the opportunities that attackers exploit.
Key secure configuration measures against ransomware:
- Disabling auto-run prevents malware from executing automatically from USB drives or downloads
- Removing unnecessary software eliminates potential vulnerabilities
- Disabling macro execution by default in Office applications blocks a major ransomware delivery mechanism
- Removing admin privileges from standard users prevents ransomware from gaining elevated access
Removing administrative privileges from standard user accounts is one of the single most effective defences against ransomware. Without admin rights, ransomware can only encrypt files the user has direct access to — it cannot install itself system-wide, modify system files, or spread across the network.
Control 3: User Access Control — Stopping Credential Theft
Ransomware gangs increasingly use stolen credentials to gain initial access to networks. They purchase leaked passwords from dark web marketplaces, use brute-force attacks, or steal credentials through phishing. MFA and proper access control make this dramatically harder.
Control 4: Malware Protection — The Direct Defence
Anti-malware software is the most direct defence against ransomware. Modern endpoint protection solutions use a combination of signature-based detection, behavioural analysis, and machine learning to identify and block ransomware before it can execute.
CE+ requires that all devices have active, up-to-date malware protection. This means:
- Anti-malware software is installed on every device
- Real-time scanning is enabled
- Definitions are updated at least daily
- Users cannot disable the protection
Control 5: Patch Management — Closing the Vulnerabilities
Many of the most devastating ransomware attacks exploited known vulnerabilities for which patches were already available. WannaCry exploited a Windows SMB vulnerability (EternalBlue) that Microsoft had patched two months before the attack. Organisations that had applied the patch were unaffected.
CE+ requires all security patches rated high or critical to be applied within 14 days. This directly prevents ransomware that exploits known vulnerabilities.
The Multi-Layered Defence
The real power of Cyber Essentials Plus against ransomware comes from the combination of all five controls working together. No single control is a silver bullet, but together they create multiple barriers that ransomware must overcome:
CE+ Is Not Enough on Its Own
While Cyber Essentials Plus provides an excellent defence against ransomware, it is important to understand that no single certification makes you invulnerable. CE+ should be complemented with:
- Regular, tested backups following the 3-2-1 rule (3 copies, 2 media types, 1 off-site)
- Immutable backups that cannot be encrypted or deleted by ransomware
- An incident response plan that your team has practised
- Security awareness training to help staff recognise phishing attempts
- Email filtering with advanced threat protection
- Network monitoring for early detection of suspicious activity
The Insurance Connection
Cyber insurance providers have tightened their requirements dramatically in response to the ransomware epidemic. Many now require Cyber Essentials Plus as a minimum condition for coverage. Even where it is not mandatory, CE+ certification can result in lower premiums and broader coverage — because insurers recognise that certified organisations present a lower risk.
How Cloudswitched Helps
Cloudswitched provides a fully managed Cyber Essentials Plus certification service that builds a multi-layered defence against ransomware. We handle the entire process — from gap assessment and remediation to vulnerability testing, examination, and ongoing support. Beyond CE+, we can advise on backup strategies, incident response planning, and additional security measures to provide comprehensive ransomware protection.
Ready to Get Certified?
Cloudswitched handles your entire Cyber Essentials Plus certification end-to-end. Build a verified, multi-layered defence against ransomware and other common cyber threats.
View CE+ Services
CloudSwitched
Centrally located in London, Shoreditch, we offer a range of IT services and solutions to small/medium sized companies.