A Ransomware Recovery Plan for Small and Medium Businesses

Before an attack: prepare

• Keep tested, offsite backups, including at least one immutable copy
• Write down who to call and in what order
• Keep a printed copy of key contacts
• Switch on multi-factor authentication
• Keep systems patched

During an attack: contain

1. Disconnect affected devices from the network
2. Do not switch them off unless advised, as that can destroy evidence
3. Isolate servers and shared drives where possible
4. Call your IT provider and your cyber insurer

Report it

If personal data may be affected, you may need to report to the Information Commissioner’s Office within 72 hours. You can also report to Action Fraud and consult the National Cyber Security Centre’s guidance.

Recovering

1. Work out how the attackers got in and close the gap
2. Choose a restore point from before the incident
3. Scan the data before restoring it
4. Rebuild affected systems cleanly
5. Restore in priority order: the systems your business needs first

Afterwards

• Change passwords and review access
• Review what happened and update your plan
• Tell your team what to watch for

See our guide to disaster recovery planning and learn about immutable backup.