risk
Ransomware disrupting operations and data availability
Criminal groups deploy ransomware that encrypts systems and data, disrupting operations, causing losses, and demanding extortion payment — a high-impact convergence of malware, availability, and continuity risk.
In catalog since 2026-09-17T22:28:00Z · Last changed 2026-09-17T22:28:00Z (f368a6cce277)
Record JSON · Open in map · Data retrieval guide
Catalog revision: 791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4. A connection does not establish full coverage.
Attributes
- category
- cyber_security
- domain
- Secure Development (SDLC) & Application Security
- Business Continuity & Disaster Recovery
- Incident Management & Response
- taxonomy
- basel-operational-risk
- coso-erm-risk
- inherent_rating
- critical
Details
- risk_id
- sdlc-ransomware
- category
- cyber_security
- likelihood
- medium
- impact
- critical
- inherent_rating
- critical
- treatment
- mitigate
- taxonomies
- basel-operational-risk
- coso-erm-risk
Source
No record-specific source URL is provided.
Connections
- UC-BCDR-07 — Execute recovery plans to restore systems and operations mitigates Ransomware disrupting operations and data availability
- strength
- related
- rationale
- executing recovery to a verified known-good state restores operations after ransomware
- UC-IR-06 — Respond to, contain, and eradicate declared incidents mitigates Ransomware disrupting operations and data availability
- strength
- primary
- rationale
- Isolating affected systems halts ransomware encryption spread and eradication removes the malware, directly limiting availability/continuity impact.
- UC-BCDR-03 — Back up data and verify restorability mitigates Ransomware disrupting operations and data availability
- strength
- primary
- rationale
- backups kept separate and protected from modification, integrity-verified before use, enable clean restore after ransomware encryption
- UC-BCDR-06 — Resolve operational incidents and eliminate root causes mitigates Ransomware disrupting operations and data availability
- strength
- related
- rationale
- severity-based incident response contains and escalates a ransomware event toward restoration
- UC-NET-06 — Enforce separation with hardware and software mechanisms mitigates Ransomware disrupting operations and data availability
- strength
- related
- rationale
- Hardware-enforced separation and non-modifiable executables resist ransomware tampering with and spreading through critical code.
- UC-NET-04 — Isolate system, user, and security functions mitigates Ransomware disrupting operations and data availability
- strength
- primary
- rationale
- Partitioning the system into separate domains of differing sensitivity limits ransomware lateral spread and blast radius (mustKeep).
- UC-IR-05 — Assess and validate incident scope, impact, and magnitude mitigates Ransomware disrupting operations and data availability
- strength
- related
- rationale
- Assessing encryption scope and service disruption sizes ransomware impact so containment and recovery can be prioritized.
- UC-SDLC-04 — Engineer systems with secure architecture and design mitigates Ransomware disrupting operations and data availability
- strength
- related
- rationale
- Isolation of execution domains and least privilege limit ransomware lateral spread and impact.
- UC-IR-09 — Recover from incidents using defined initiation criteria mitigates Ransomware disrupting operations and data availability
- strength
- primary
- rationale
- Restoring affected systems and data to a verified known-good state directly reverses ransomware's availability and continuity impact.
- UC-SDLC-05 — Enforce secure coding and input validation standards mitigates Ransomware disrupting operations and data availability
- strength
- related
- rationale
- Reducing exploitable input/coding defects narrows the initial-access vulnerabilities ransomware exploits.