Ransomware Protection for Small Businesses: A Plan

Ransomware can lock every file your business depends on overnight, and many criminal groups now steal data before they encrypt it. This playbook shows you how to make an attack survivable: backups you can actually restore, fewer ways in, a smaller blast radius and a response you have practiced before you need it.

Pink padlock lying on a laptop keyboard lit with red and green light — Ransomware protection is less about one clever tool and more about several simple layers working together.

Key takeaways

Your backups decide whether ransomware is a bad week or a business-ending event. Follow the 3-2-1 rule, keep one copy offline or unchangeable, and test restores.
Most attacks start through phishing, stolen passwords or unpatched systems, so patching, MFA and email filtering close the usual doors.
Least privilege and separate admin accounts limit how far an attack can spread inside your network.
If you are hit, isolate affected devices but do not wipe them, then call your IT support, insurer and law enforcement before any decision about paying.

Ransomware is malicious software that encrypts your files so you cannot open them, followed by a demand for payment in exchange for a key. Many groups now copy your data first and threaten to publish it if you refuse, which means even a business with good backups can face pressure. For a small company, the real damage is usually downtime: no invoices, no customer records, no bookings, no payroll files, for days or weeks.

The good news is that ransomware relies on the same weaknesses as most other attacks. A business that keeps strong backups, patches promptly, uses multi-factor authentication (MFA) and gives people only the access they need is a much harder target, and a much faster one to recover. This plan breaks the work into four layers you can tackle one at a time. It builds on our general cybersecurity checklist and backup checklist, so here we focus on the ransomware-specific details.

How ransomware gets into a small business

Knowing the common entry points tells you where to spend your effort first. You do not need technical detail on how attacks work, just a clear picture of the doors that are usually left open.

The usual ways in

Phishing emails: a message with a malicious attachment or link that tricks someone into running harmful software or handing over a login.
Stolen or reused passwords: criminals try passwords leaked from other websites against your email, remote access tools and cloud apps. Without MFA, one reused password can be enough.
Unpatched systems: known flaws in routers, firewalls, remote access software, servers and old operating systems are scanned for automatically across the internet.
Exposed remote access: remote desktop or file-sharing services left open to the internet without strong protection.
Suppliers and IT providers: an attacker who compromises a provider with access to your systems may be able to reach you through them.

What happens after they get in

Attackers rarely encrypt files the moment they arrive. They often spend time looking around, collecting passwords, finding backups and copying data. Then they encrypt as much as they can reach at once, frequently at night or over a weekend. This is why a backup drive that stays plugged in, or a backup account using the same admin password, can be encrypted along with everything else.

Common mistake

Treating cloud file sync as a backup. If ransomware encrypts files on a laptop, a sync service may faithfully copy the encrypted versions to the cloud. Some services keep file history that can help, but sync is designed to mirror changes, not to protect you from them. Use a real backup with separate versions and separate credentials.

Layer 1: build backups that survive an attack

Backups are the single most important part of ransomware protection. If you can restore clean data quickly, the attacker loses most of their leverage over your operations.

3-2-1 Keep 3 copies of important data, on 2 different types of storage, with 1 copy stored off-site Widely used backup rule of thumb

For ransomware, add one extra condition: at least one copy must be offline or immutable. Offline means physically disconnected from your network when not in use, such as a drive you rotate and store away. Immutable means the backup service will not allow files to be changed or deleted for a set period, even by an admin account. Many business backup services offer this as a setting, so ask your provider whether it is turned on.

List what matters. Accounting data, customer records, contracts, email, design files, website content and any line-of-business database. Note where each one lives.
Back up cloud apps too. Email and online office suites are not automatically backed up in a way that lets you restore everything after a mass deletion or encryption. Check what your provider actually keeps and for how long.
Separate the credentials. Use a different, MFA-protected account for your backup system, not the same admin login used day to day.
Keep one copy out of reach. Offline, immutable or both.
Test a full restore. Pick a realistic scenario, such as "the main laptop is gone", and time how long it takes to get working again.

Pro tip

Write down how long you could survive without each system, then compare it with how long a restore actually takes. If your invoicing must be back within a day but a restore takes three, you have found the gap to fix first.

A long aisle inside a server room lined with metal equipment racks — Wherever your data lives, at least one copy should sit beyond the reach of an attacker who gets into your network.

Layer 2: close the common doors

The second layer makes it harder for ransomware to get in at all. None of these controls is exotic, and most small businesses can put them in place with the tools they already pay for.

Control	What it blocks	Where to start
Patching	Attacks on known software flaws	Automatic updates on all devices; check routers, firewalls and remote access tools monthly
MFA	Logins with stolen or reused passwords	Email, remote access, backup console, admin accounts
Email filtering	Malicious attachments and links	Turn on the protection features in your email service and review quarantine settings
Endpoint protection	Known malware and suspicious behavior on devices	Built-in tools at minimum, central management as you grow
Remote access review	Exposed services scanned from the internet	Ask your IT provider what is reachable from outside and close what you do not need

Patching without the pain

Turn on automatic updates for operating systems, browsers and business apps. Then make a short monthly list of devices that do not update themselves: routers, firewalls, network storage boxes, printers and any server. Replace equipment that no longer receives security updates. If you hold UK Cyber Essentials, remember the scheme expects high-risk or critical updates to be applied within 14 days of release, which is a sensible target for anyone.

Make MFA non-negotiable

Remote access and email are the priority. Authenticator apps, passkeys or security keys are stronger than text message codes, but any MFA is far better than none. Protect the backup console with MFA as well, so an attacker with a stolen admin password cannot delete your safety net.

Layer 3: limit the blast radius

Assume that one day something will get through. The third layer decides whether that means one infected laptop or a fully encrypted business.

Least privilege: give each person access only to the folders and systems their job needs. Ransomware running under a junior account can only encrypt what that account can reach.
Separate admin accounts: nobody should read email or browse the web while logged in as an administrator. Keep a small number of admin accounts and use them only for admin tasks.
Tidy shared drives: a single shared folder that everyone can edit is convenient, and it is also the first thing to be encrypted. Split it by team or purpose.
Separate networks: keep guest Wi-Fi, smart devices and card terminals away from the network that holds your business data. Your IT provider can set this up on most business routers.
Remove what you do not use: old accounts, unused software and forgotten servers are easy targets because nobody is watching them.

Example

Imagine a fictional six-person architecture studio, Harbor Lane Design. A junior designer opens a fake invoice attachment late on a Friday. Because the studio split its shared drive by project and the designer has access to only two project folders, only those folders are encrypted. Endpoint protection flags the activity, the owner unplugs the laptop from the network, and the studio restores the two folders from its immutable backup on Monday morning. Without those controls, the same click could have encrypted the whole file server and the backup drive plugged into it.

Layer 4: prepare your ransomware response

The final layer is a plan for the worst day. Decisions made in a panic tend to destroy evidence or make things worse, so write the steps down now.

Isolate, do not wipe. Disconnect affected devices from the network and Wi-Fi. Do not wipe them or power them off before you have taken advice, because evidence on the device may help investigators and your insurer.
Start a written log. Note times, what you saw, who you called and what you did. It will matter later.
Call your support. Your IT provider, your cyber insurer's incident hotline if you have one, and your bank if payment systems may be affected.
Report it. In England, Wales and Northern Ireland, report to Report Fraud (reportfraud.police.uk, 0300 123 2040), which replaced Action Fraud in December 2025. In Scotland, call Police Scotland on 101. In the US, report to the FBI's Internet Crime Complaint Center at ic3.gov.
Check data duties. If personal data may have been accessed or encrypted, you may need to report it. In the UK, personal data breaches that pose a risk to people must be reported to the ICO within 72 hours of becoming aware. US state notification laws vary.
Change passwords from a clean device. Start with email, admin and backup accounts.
Restore carefully. Make sure the way in has been found and closed before restoring, or you may be encrypted again.

Should you ever pay?

Paying a ransom does not guarantee you get your files back, that the decryption tool works properly or that stolen data is deleted. It can also mark you as a business willing to pay. In some cases payment may be illegal, for example if the criminal group is subject to sanctions. Never make this decision alone: involve law enforcement, your insurer and qualified legal advice. This article is general information, not legal advice, and the rules on reporting and payments can change, so check current guidance from the NCSC, the ICO, CISA or a qualified adviser.

Pro tip

Print your response plan and contact list and keep a copy somewhere other than your computers. If ransomware encrypts your file server, a plan saved only on that server is no help.

Keep the plan alive

A ransomware plan written once and forgotten quickly goes stale. People leave, providers change and new systems appear. Build a light routine:

Monthly: confirm backups ran and check devices that do not update automatically.
Quarterly: review who has access to what, remove old accounts and run a small test restore.
Twice a year: walk through the response steps with the people involved, using a simple "what if" scenario.
Yearly: run a full restore test and review your cyber insurance, if you have it.

Short, regular security reminders for staff help too. Free resources such as the NCSC's small business guidance in the UK and CISA's ransomware material in the US are written with small teams in mind.

Your ransomware protection plan

3-2-1 backups covering files, email and cloud apps
At least one backup copy offline or immutable
Separate, MFA-protected login for the backup system
A full restore tested and timed
Automatic updates on, plus a monthly check of routers and servers
MFA on email, remote access and admin accounts
Email filtering and endpoint protection on every device
Least-privilege access and separate admin accounts
Shared drives split by team or project
A printed response plan with IT, insurer, bank and police contacts

Frequently asked questions

Can antivirus alone stop ransomware?

No. Endpoint protection blocks a lot of known malware and some suspicious behavior, but new variants and attacks that use stolen logins can get past it. It works best as one layer alongside backups, patching, MFA and least privilege.

Is a small business really worth targeting?

Yes. Many attacks are automated and look for any weak password or unpatched system. Small businesses are often hit because they have fewer defenses, not because anyone chose them specifically.

How often should I test my backups?

Run a small restore every quarter and a full restore of a key system at least once a year. Also test after any major change, such as moving to a new backup service.

Does cyber insurance cover ransomware?

Many policies cover incident response, data recovery and business interruption, but cover varies widely. Read the exclusions and conditions, because insurers often expect controls such as MFA and backups to be in place.

The bottom line

Ransomware protection for a small business comes down to four layers: backups that survive an attack, fewer ways in, a smaller blast radius and a rehearsed response. You do not need to do it all this week. Start with an offline or immutable backup and a tested restore, then add MFA and patching, and you will already be far harder to hold to ransom.