Small business ransomware protection and recovery plan

Protecting a small business from ransomware comes down to two jobs. First, close the common ways in: unpatched internet-facing systems, stolen passwords, and phishing. Second, make sure you can recover without paying, which means backups the attacker cannot reach, a restore you have actually tested, and a short written plan for the first hour. The steps below follow the federal #StopRansomware Guide from CISA, scaled to an office without an IT department.

What is ransomware?

Ransomware is malicious software that encrypts (scrambles) your files so they cannot be opened, then demands payment for the key. Many groups also copy data out first and threaten to publish it, so an attack can be both an outage and a data breach.

How common is it, and do victims pay?

Verizon’s 2026 Data Breach Investigations Report found ransomware in 48% of all breaches it analyzed, up from 44% the year before, and says small organizations are disproportionately affected. The same report found that 69% of ransomware victims did not pay, and that the median payment among those who did was $139,875.

The FBI received more than 3,600 ransomware complaints in 2025. Among the 1,400 or so from organizations outside critical infrastructure, the most reported industries were legal services (18%) and contracting services such as electricians and general contractors (17%). Ordinary small firms are well represented.

On paying, CISA’s position is measured: some victims pay, but there is no guarantee they will recover their files. The goal of everything below is to make that a decision you never face.

How does ransomware get in?

CISA groups its prevention advice by the ways attackers first get access:

1. Internet-facing weaknesses. Unpatched firewalls, VPNs, and servers, or remote desktop exposed to the internet. Verizon’s report found exploitation of vulnerabilities was the most common way into breaches overall at 31%, and that only 26% of the most critical vulnerabilities were fully fixed by organizations during the year.
2. Stolen or reused passwords, especially on remote access and email without multi-factor authentication.
3. Phishing emails with links or attachments.
4. Malware already on a machine from an earlier infection.
5. Persuasion by phone or message, such as a fake IT support request for remote access.
6. A compromised vendor or service provider that has access to your systems.

Prevention checklist

Control	What to do	Why it matters
Patching	Turn on automatic updates for Windows, macOS, browsers, and Microsoft 365 apps. Assign someone to update the firewall, VPN, NAS, and Wi-Fi equipment, which do not update themselves	Closes the most common way in
Unsupported systems	Replace or isolate anything that no longer receives security updates, including Windows 10 PCs that are not enrolled in Microsoft’s Extended Security Updates program. Windows 10 reached end of support on October 14, 2025	An unpatched system stays vulnerable permanently
Remote access	Do not expose remote desktop (RDP) to the internet. Put remote access behind a VPN or a cloud service that requires multi-factor authentication	CISA specifically warns against exposed RDP
Multi-factor authentication	Require it for email, remote access, admin accounts, and backup consoles	A stolen password alone stops being enough
Passwords	Unique passwords in a password manager. Change default passwords on every device	Reused passwords are tried everywhere
Least privilege	Staff work from standard accounts, not administrator accounts. Remove access when people leave	Limits how far one compromised account reaches
Endpoint protection	Use security software with behavior detection (often called EDR) on every computer and server	Can stop encryption in progress and records what happened
Email protections	Filtering, sender authentication (DMARC), and Office macros blocked for files from the internet	Removes many lures before anyone sees them
Staff awareness	Short, regular practice on spotting and reporting suspicious messages	Phishing and phone pretexts target people
Network segmentation	Keep guest Wi-Fi, cameras, and smart devices on a separate network from business computers	Slows the spread between devices

Related guides: patch management, MFA methods ranked, the phishing checklist for staff, and how to run security awareness training.

If the list is more than you can take on at once, start with three: multi-factor authentication on email and remote access, automatic updates plus a firewall update, and one offline backup.

Backups that survive an attack

CISA’s first recommendation is to maintain offline, encrypted backups of critical data and regularly test them. The word “offline” carries the weight. CISA notes that many ransomware variants look for reachable backups and delete or encrypt them. The FBI’s 2025 report adds that backups should be immutable, meaning they cannot be altered or deleted for a set period.

In practice:

• Keep at least one copy the office network cannot reach. Options include a cloud backup service with immutability or object lock turned on, or external drives that are rotated and physically unplugged. A USB drive left connected, or a network storage box that stays signed in, is reachable and will likely be encrypted with everything else.
• Separate the backup login. The backup service should have its own password and multi-factor authentication, not the same admin account used for daily work.
• Syncing is not backup. OneDrive, Google Drive, and Dropbox sync changes, including encrypted files, to every device. Version history helps, but it is not a substitute for an independent copy.
• Include everything you would miss: file shares, accounting data, line-of-business databases, email, and cloud data.
• Test a restore. Once a quarter, restore a real folder and time it. Once a year, walk through restoring a whole computer or server. An untested backup is an assumption.

Our business data backup guide goes deeper on methods and retention.

Recovery readiness: what to prepare now

These take an afternoon and decide whether recovery takes days or weeks.

• A one-page plan, printed. Who decides, who does what, and the order of steps below. If the network is down, a plan stored on the network is unavailable. Our incident response plan post has a fuller outline.
• A contact list kept off the network: IT support, cyber insurer’s claim line and policy number, bank, key software vendors, and an attorney.
• An inventory of computers, servers, cloud services, and where each system’s data and backups live.
• Priorities. Which systems must come back first (scheduling, billing, phones), and how long you can operate without each.
• Rebuild materials. Installers, license keys, and configuration notes for key applications. CISA recommends keeping “golden images,” ready-made copies of a configured system, for the same reason.
• Insurance requirements. If you carry cyber insurance, know who you must notify and whether the policy requires you to use its own response firm.

What to do in the first hour of an attack

This order follows CISA’s response checklist.

1. Isolate affected devices immediately. Unplug the network cable and turn off Wi-Fi. If several machines are affected, disconnect the network at the switch or router.
2. Power down only if you cannot disconnect. CISA advises this as a last resort because shutting down erases evidence held in memory.
3. Do not use possibly compromised email or chat to coordinate. CISA recommends out-of-band communication such as phone calls, because attackers sometimes watch for signs they have been noticed.
4. Contact your IT support and your insurer using the printed contact list.
5. Work out what is affected and what is most urgent to restore. Photograph the ransom note and keep a timeline.
6. Protect the backups. Confirm they are intact and keep them disconnected until the environment is clean.
7. Reset passwords for email, admin, and remote access accounts from a device you know is clean.
8. Report it. CISA takes reports at cisa.gov/report and the FBI at ic3.gov.
9. Do not restore onto infected machines. Wipe and rebuild, fix the way the attacker got in, then restore data.

If data was copied, you may have legal duties to notify customers or regulators, so involve an attorney early.

Trade-offs and honest limits

No set of controls makes ransomware impossible. The realistic aim is to make an attack less likely and recovery routine.

Spend in proportion to what you run. An office where everything lives in Microsoft 365 or Google Workspace, with no server and no remote desktop, has a much smaller problem: multi-factor authentication, patched computers, endpoint protection, and an independent backup of cloud data cover most of it. An office with an on-site server, remote access, and specialist software has more to protect and should work through the whole checklist.

Offline backups add a small recurring chore or a monthly fee. Restore tests take an hour or two. Those are the costs. The alternative is finding out during an outage that the backup was reachable, incomplete, or months old.

Common mistakes

• Leaving the backup drive plugged in all the time.
• Treating file syncing as a backup.
• Never testing a restore.
• Updating computers but never the firewall, VPN, or storage device.
• Day-to-day work done from an administrator account.
• Restoring data before finding and fixing the way in.

Common questions

Should a small business pay the ransom?

It is a business and legal decision, and one to make with your insurer and an attorney. CISA notes that paying does not guarantee you get your files back. In Verizon’s 2026 data, 69% of victims did not pay. Working, offline backups are what make refusing possible.

Does antivirus stop ransomware?

Modern endpoint protection stops a good share of it, especially products that watch for suspicious behavior such as mass file encryption. It is one layer. It cannot help if an attacker signs in with a stolen password and works like a legitimate user, which is why multi-factor authentication, patching, and offline backups matter as much.

Are files in OneDrive or Google Drive safe from ransomware?

Safer, not safe. Encrypted files on a computer sync to the cloud like any other change. Version history and restore features can often roll files back, but they are recovery conveniences inside the same account, not an independent copy. Keep a separate backup of important cloud data.

How long does recovery take?

It depends on how much data you have, how fast your backup restores, and how many machines need rebuilding. The only reliable way to know is to time a test restore. If the answer is longer than your business can tolerate, that tells you what to change now.

How we can help

Coastal Growth Co. helps small businesses in Orange County get ransomware-ready: reviewing how backups are set up and whether they restore, closing exposed remote access, turning on multi-factor authentication, and writing a one-page recovery plan. See our managed IT services or get in touch. Scope and price are agreed before any paid work begins.