SMB1001 addresses the kinds of controls that would have reduced the impact of both attacks. Firewalls, antivirus, automatic updates, staff training, backup and recovery, and access management all directly map to the common attack paths used by ransomware operators.
The strength of SMB1001 is that it is not just a technical checklist. It creates a repeatable way to prove that the basics are in place, maintained, and understood across the organisation, which matters when your team is dealing with multiple schemes, constant email volume, and time-sensitive requests.
A simple example: if an attacker compromises one account through a phishing email, MFA, least-privilege access, patching, and strong backups can limit how far they move and how much downtime follows. That is the difference between a manageable incident and a major business interruption.