The Department of Energy’s Ransomware Countermeasures and Response

Conduct an analysis or risk assessment that evaluates ransomware threats and the cost to fully recover from a ransomware event, including considerations in the Department’s guidance on Analyzing Ransomware Risk: A Blueprint for Quantification.

"Develop and implement a process to perform continuous monitoring activities to
fully evaluate third-party providers’ information technology environments for security changes or threats."

Develop and conduct contingency plan and incident response testing exercises that include and/or mimic a ransomware event and incorporate the lessons learned into the site’s recovery and response capabilities.

Implement more effective oversight of data protection by the Information Technology Services Directorate, such as a review process, to determine what data should be backed up and ensure that appropriate corrective actions are taken.

Ensure that the contractual requirements included in applicable Department directives are flowed down to the support subcontractors or define specific reporting requirements for when an event occurs such as a ransomware attack.