It makes sense (to me) that ransomware isn't mentioned, as this is a checklist of controls - not of threats. Many of these controls do help in preventing ransomware: 2FA, "Backup, test your backups, then backup again", "Isolate assets at the network level", etc.