The National Institute of Standards and Technology (NIST) is taking public comment on the new draft of its Ransomware Profile until Oct. 8. Managed security service providers may want to chime in.

The document contains the recommendations from the agency (which doesn’t have regulatory power) for helping organizations tackle ransomware.

Without a doubt, the issue is a pressing one. In the second quarter of 2021 alone, ransomware activity soared 55,240%. That’s not a typo. That’s the figure from MSSP Nuspire in its 2021 Q2 Quarterly Threat Landscape Report.

With that in mind, here are the “basic preventative steps” NIST details in its Ransomware Profile:

The Basics Are Always Important

These insights seem rudimentary, but as cyberattacks rise exponentially, the industry has discovered that even the simplest gaps have gone overlooked. That was understandable during the crush last year to shift to remote work because of the pandemic. However, the time has long since passed to review those deployments for holes. In essence, the fundamentals bear repeating and employees – yours and your clients’ – continue to need cybersecurity training.

NIST underscores those points in the draft Ransomware Profile. The agency lays out steps organizations should take now to recover from a ransomware incident later:

NIST modeled the Ransomware Profile on its Cybersecurity Framework Version 1.1. The new draft guidance is the second version, following one released this summer. The recommendations come not long after the Biden Administration issued its own measures aimed at fighting ransomware. Government agencies and contractors have suffered heavy attack over the past year from hackers, and they aren’t letting up. Just last week, the feds issued an advisory indicating that more than 400 U.S. and international organizations have come under digital fire from the Conti ransomware.