The FBI Ransomware Prevention Guide refers to the #StopRansomware Guide, a joint publication from CISA, the FBI, NSA, and the Multi-State Information Sharing and Analysis Center (MS-ISAC). It lays out specific controls, monitoring practices, and recovery steps organizations can use to stop ransomware before it spreads and to survive an attack that gets through. The guide was first issued by CISA and MS-ISAC in September 2020, then reissued as version 1.1/2.0 on May 23, 2023, with the FBI and NSA added as co-authors, according to the joint CISA/NSA release. That update reflects how ransomware tactics have shifted since the guide's original release, and it remains the current baseline federal agencies point to when organizations ask what to do.
Table of Contents
- What controls does the guide require?
- How should organizations monitor for an active intrusion?
- Why offline backups matter more than any other recovery step
- Should a victim pay the ransom?
- How big is the ransomware problem right now?
- Frequently Asked Questions
What controls does the guide require?
The 2023 guide treats multi-factor authentication (MFA) as non-negotiable, specifically phishing-resistant MFA on every service, with email, VPNs, and any account that touches critical systems named as top priorities. Organizations are told to escalate any system or user that isn't enforcing it to senior leadership, according to CISA's guide — a framing that turns MFA gaps into an executive-level problem rather than an IT backlog item. The guide also directs organizations to patch and securely configure every internet-facing asset: VPNs, network infrastructure, and remote-access endpoints are named specifically, since these are the entry points ransomware operators scan for first.
Beyond perimeter hardening, the same guide calls for network segmentation — separating IT networks from operational technology (OT) — under a zero-trust approach, so that a single compromised account or device can't move freely across the network, per CISA, NSA, FBI, and MS-ISAC. Segmentation matters because most ransomware doesn't start where it does the most damage. An attacker who lands on one workstation typically needs to move laterally — hopping from account to account, system to system — before reaching the servers or backups worth encrypting. Cutting off that lateral path is one of the few controls that can stop an intrusion already in progress, not just prevent the initial entry.
How should organizations monitor for an active intrusion?
The guide recommends threat hunting focused on two early indicators: newly created or newly privileged Active Directory accounts, and anomalous VPN or remote-access logins, according to the same CISA guidance. Both show up well before encryption begins, because ransomware operators typically establish persistent access and elevate their privileges days or weeks ahead of deploying the payload.
That lead time is the practical value of this monitoring. An account that suddenly gains administrative rights, or a VPN login from an unexpected location or at an unusual hour, is often the only visible sign of an intrusion before it becomes a full-blown incident. Security teams that treat these as high-priority alerts — rather than noise to review later — have a real chance of containing an attack before files are encrypted.
Why offline backups matter more than any other recovery step
The guide's prevention section leads with maintaining offline, encrypted, and regularly tested backups of critical data, paired with a tested incident response and business continuity plan, as the primary defense against data loss, per the joint guide. "Offline" is the operative word — a backup that stays connected to the network can be encrypted or deleted by the same attacker who hit production systems.
Testing matters as much as existence. A backup that hasn't been restored recently is a guess, not a safety net; organizations only learn whether a backup actually works when they try to use it. Pairing backups with a rehearsed incident response plan means staff know who does what during an attack, instead of improvising while systems are down.
Should a victim pay the ransom?
The FBI and CISA jointly advise against paying. Payment doesn't guarantee decryption or file recovery, doesn't guarantee the attacker's access is removed, and can mark the victim as willing to pay again, according to FBI and CISA guidance.
FBI Director Christopher Wray put it directly to the Senate: "there is no guarantee whatsoever that you are going to get your data back." Regardless of whether an organization pays, the FBI and CISA ask that every ransomware incident be reported — either to a local FBI field office, through IC3.gov, or directly to CISA, per CISA's reporting guidance. Victim reporting is what feeds the indicators and tactics that end up in future joint advisories, so a single report can help defend other organizations against the same attacker.
How big is the ransomware problem right now?
The FBI's 2025 Internet Crime Report recorded 3,611 ransomware complaints with roughly $32 million in reported losses, up from 3,156 complaints and about $12 million in 2024, and it tracked 63 new ransomware variants during the year, according to the IC3 report. Fourteen of the sixteen U.S. critical infrastructure sectors were hit by ransomware in 2025, with Akira, Qilin, RansomHub, LockBit, and Medusa causing the most impact and healthcare remaining among the most targeted sectors, per coverage of the FBI's Cyber Division findings.
Those dollar figures understate the real damage. IC3 tracked more than 1,008,597 total cybercrime complaints in 2025 with about $20.9 billion in losses, and cyber-enabled fraud — not ransomware — drove roughly 85% of that total, according to reporting on the 2025 IC3 data. Ransomware's reported losses are a small slice of that figure because the $32 million counts ransom payments and direct costs, not the operational disruption of a hospital, utility, or government office locked out of its own systems for days.
Frequently Asked Questions
Who published the ransomware prevention guide the FBI follows?
CISA and MS-ISAC published it first in September 2020; the FBI and NSA joined as co-authors in the May 23, 2023 update, per the joint release.
What's the single highest-priority control in the guide?
Phishing-resistant multi-factor authentication on all services, especially email, VPNs, and critical-system accounts, with gaps escalated to senior leadership, according to CISA's guidance.
Does the FBI ever recommend paying a ransom?
No. The FBI and CISA advise against payment because it doesn't guarantee recovery and can invite further attacks, per FBI and CISA guidance.
Where should a ransomware victim report the attack?
A local FBI field office, IC3.gov, or CISA directly — reporting is requested whether or not the victim pays, according to CISA's reporting page.
You Might Also Like
- Cybersecurity — Snowflake Customer Breach Prevention Guide: Controls, Monitoring, and Recovery
- Ransomware Recovery Risk Guide: Data Exposed, Fraud, and Identity Theft
- Teen Ransomware Suspect Allegedly Led Gang Behind Hundreds of Attacks