Ransomware Playbook for Small Businesses: Prevention, Response and Recovery

Ransomware is malicious software that locks up your files and systems, followed by a demand for payment to unlock them. For a small business, it can mean days or weeks without access to customer records, invoicing, scheduling or email. Many modern attacks add a second threat: pay up, or the stolen data gets published.

It’s easy to assume ransomware gangs only chase large companies. In reality, many attacks are opportunistic. Criminals scan the internet for exposed remote access, buy stolen passwords in bulk and send phishing campaigns to thousands of businesses at once. Small organizations are attractive precisely because they tend to have fewer defenses and less ability to recover on their own.

This playbook covers the three phases that matter: preventing an attack, responding in the first critical hours, and recovering cleanly. It’s written so an owner or office manager can act on it today, and so your IT provider can pick it up and run with it.

How ransomware attacks actually happen

Ransomware is the final step of an attack, not the first. Understanding the stages shows you where to break the chain.

1. Initial access. The attacker gets in through a phishing email, a stolen password for email or VPN, an exposed Remote Desktop (RDP) service, or an unpatched firewall, VPN or web application.
2. Establishing a foothold. They install remote-access tools, create new accounts or add mailbox rules so they can come back.
3. Escalation and exploration. They look for admin credentials, map your network, and find your file servers, cloud storage and, critically, your backups.
4. Data theft. Many groups copy sensitive data out before encrypting anything, so they can threaten to leak it.
5. Encryption and extortion. They delete or encrypt backups they can reach, encrypt your systems, often at night or on a weekend, and leave a ransom note.

Notice that most of these steps rely on the attacker gaining more and more access. Every control that slows them down, from MFA to separate admin accounts, buys you time to notice. The gap between initial access and encryption can be days or weeks. That’s an opportunity: good monitoring and alerting can catch an intruder before the damage is done.

Prevention: close the common doors

You can’t make ransomware impossible, but you can make your business a much harder target than the next one. Focus on these controls, roughly in order of impact:

• MFA everywhere, especially email, VPN, remote access tools, cloud admin consoles and backup systems. Stolen passwords are useless on their own when MFA is enforced.
• No RDP exposed to the internet. Put remote access behind a VPN or remote access service with MFA, and ask your IT provider to confirm nothing is directly exposed.
• Prompt patching of operating systems and especially internet-facing devices like firewalls and VPN appliances. When a critical vulnerability is announced for equipment you use, patch within days, not months.
• Endpoint detection and response (EDR) on every computer and server, with alerts going to someone who will actually act on them, including nights and weekends.
• Least privilege. Staff shouldn’t have admin rights on their computers, and admin accounts should be separate from everyday email accounts.
• Email filtering and staff awareness, so fewer phishing messages arrive and the ones that do get reported quickly.
• Application and macro controls that block Office macros from internet files and prevent unknown programs from running.

The CISA #StopRansomware Guide is an excellent free resource with a detailed prevention checklist and response checklist your IT provider can follow.

Backups that survive an attack

Ransomware operators know backups are what let you say no. They hunt for them deliberately. A backup that sits on a network share, or uses the same admin password as everything else, will likely be encrypted or deleted along with your data.

Use the 3-2-1-1-0 approach:

Number	Rule	What it looks like for a small business
3	Three copies of your data	The live data plus two backups
2	Two different types of storage	For example, a local backup appliance and a cloud backup service
1	One copy off-site	Cloud backup or rotated drives kept at a separate location
1	One copy offline or immutable	Cloud storage with immutability (object lock) or a drive physically disconnected after each backup
0	Zero errors on restore tests	Quarterly test restores of files, mailboxes and at least one full system

Two more details matter. First, protect the backup system with separate credentials and MFA, so an attacker who gets your domain admin password can’t simply log in and delete everything. Second, know how long a full restore takes. If restoring your file server from the cloud would take four days, you need to know that before an attack, not during one. Our guide to the 3-2-1-1-0 backup strategy covers setup in detail.

Prepare before it happens

The businesses that recover fastest are the ones that decided the hard things in advance. Spend an afternoon on these:

If you don’t have a formal plan yet, our guide to building an incident response plan for a small business gives you a template to start from.

The first hour: what to do when ransomware hits

Signs of ransomware include files with strange new extensions, files that won’t open, a ransom note on the screen or in folders, or a sudden slowdown as many files change at once. When you see them, act calmly and in this order:

1. Isolate affected devices. Unplug the network cable and turn off Wi-Fi on any device showing signs of infection. If many machines are affected, disconnect your internet connection at the router or firewall.
2. Do not power off or wipe machines unless your responders tell you to. Memory and logs on running devices can hold evidence of how the attacker got in, and decryption keys are sometimes recoverable from memory.
3. Disconnect backups. If any backup drives or systems are still connected and appear unaffected, disconnect them to protect them.
4. Call for help. Contact your IT provider and your cyber insurer’s breach hotline. Many policies require you to notify them promptly and to use approved responders.
5. Use out-of-band communication. Assume the attacker may be reading your email. Coordinate by phone or a separate, unaffected channel.
6. Document everything. Write down times, what you saw, what you did and who you spoke to. Photograph the ransom note.
7. Report to law enforcement. File a report with the FBI’s Internet Crime Complaint Center (IC3) or contact your local FBI field office. CISA also accepts ransomware reports. Law enforcement may have intelligence about the group involved or even a decryption tool.

Should you pay the ransom?

This is a business decision, but it should never be made alone or in a panic. Key facts to weigh:

• The FBI does not support paying ransoms. Payment funds future attacks and doesn’t guarantee you’ll get your data back or that stolen data will be deleted.
• Decryption is often slow and incomplete. Even with a working key, restoring large amounts of data can take a long time, and some files may not recover.
• There may be legal risk. The U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) has warned that paying ransoms to sanctioned individuals or groups can violate U.S. sanctions law.
• Paying can mark you as a willing payer and doesn’t fix the security gap that let attackers in.

If you are considering payment, involve your attorney, your insurer and law enforcement before any decision. Good, tested backups are what turn this from an agonizing choice into an easy “no.”

Recovery, notification and lessons learned

Recover cleanly

• Find and close the entry point first: the phished account, the exposed service or the unpatched device.
• Rebuild rather than clean affected machines where possible, using fresh installs, then restore data from backups taken before the compromise.
• Reset credentials for all accounts, starting with admin, email and backup accounts, from known-clean devices. Revoke active sessions and remove any accounts the attacker created.
• Restore in priority order using the critical systems list you prepared earlier.
• Watch closely for several weeks afterward for signs the attacker is trying to return.

Know your notification obligations

If personal information was accessed or stolen, you may have legal obligations to notify affected customers, employees or regulators. Every U.S. state has its own data breach notification law, and regulated data brings additional rules, such as the HIPAA Breach Notification Rule for health information and card brand requirements for payment data under PCI DSS. Your attorney and insurer can help you work out what applies.

Run a lessons-learned review

Within a few weeks, sit down with everyone involved and ask: How did they get in? What slowed us down? What worked? Turn the answers into a short list of fixes with owners and deadlines.

How SecuritySage can help

We help small businesses get ransomware-ready before it matters: reviewing remote access and patching, checking that backups are truly isolated and restorable, writing a response plan your team can follow under pressure, and running tabletop exercises so everyone knows their role. If you’d like to see where you stand today, our free security risk assessment takes just a few minutes.

Prefer to learn at your own pace? Our Ransomware Readiness Bootcamp walks owners and office managers through prevention, backups and response step by step. And when you’re ready for hands-on help, get started with SecuritySage and we’ll build a ransomware plan that lets you focus on growth with confidence.