Ransomware
Ransomware is malware that locks or scrambles your files so you cannot open them, then demands payment to unlock them. Cyber Essentials has no separate ransomware control. It reduces the risk through malware protection (A8.1), separate administrator accounts (A7.6 and A7.7) and prompt security updates (A6.4 and A6.5).
- Term
- Ransomware
- Also known as
- Crypto-ransomware
- Category
- Malware, cloud and threats
- Requirement area
- 4. User Access Control; 5. Malware protection
- Questions
- None directly
- Reviewed against
- Requirements v3.3
What does the term ransomware mean in Cyber Essentials?
Ransomware is malware that locks or scrambles your files so you cannot open them, then demands payment to unlock them.
Using Jody’s administrative privileges, a type of malware known as ransomware encrypts all of the data on the network and then demands a ransom.
How does ransomware apply to Cyber Essentials?
In plain terms
Imagine someone breaking into your office, putting every filing cabinet inside a locked cage and leaving a note with a price for the key. Ransomware does that to your computers. Invoices, customer records and shared drives become unreadable until you restore them from a copy or the attacker unlocks them.
What Cyber Essentials asks
The requirements name ransomware twice. The malware protection section lists it alongside viruses and worms as a type of malware. The user access control section uses it as its main example: Jody is logged in with an administrative account and opens a malicious attachment. The NCSC's conclusion: "The ransomware was able to encrypt far more data than would have been possible with standard user privileges, making the problem that much more serious."
That is why the scheme insists on separate accounts for admin work. A7.6 asks how you make sure separate accounts are used for administrative tasks, and A7.7 how you stop administrator accounts being used for email and web browsing.
What helps most
- Malware protection on every device (A8.1 to A8.5), so the ransomware is blocked before it runs.
- Security updates within 14 days (A6.4 and A6.5, both automatic fails if answered No), so it cannot get in through a known weakness.
- Backups. They are not a technical requirement of Cyber Essentials, but v3.3 emphasises them: a recent copy "will help you recover quicker if your data is lost or stolen."
See user access control and does Cyber Essentials require backups?. Related: malware, encryption, administrator account.
Related terms
- BackupA backup is a copy of your information saved to another device or to cloud storage, so you can recover it if the original is lost.
- MalwareMalware is software that someone has written and spread on purpose to cause harm, such as computer viruses, worms and ransomware.
- EncryptionEncryption is scrambling information with a secret key so that only someone holding the right key can read it.
- Administrator accountAn administrator account is a login with extra powers, such as installing software, changing security settings and creating other accounts.
- SaaS (Software as a Service)Software as a Service (SaaS) is software you use over the internet through a subscription and a login, such as Microsoft 365 or Gmail, where the provider runs everything behind it.
- SandboxingSandboxing is running a program inside a sealed-off space on a device, so that anything it does cannot reach the rest of the system or your data.
Frequently asked questions
Ransomware is malware that locks or scrambles your files so you cannot open them, then demands payment to unlock them. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
Ransomware relates to 4. User Access Control; 5. Malware protection in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.