Recovery begins before ransomware
Ransomware can prevent access to files and systems, while data-extortion actors may also threaten to release information they copied. CISA, the FBI, and other partners recommend offline or otherwise protected backups, regular restoration tests, multifactor authentication, vulnerability management, and an exercised incident-response plan.
The important business question is not “Do we have backups?” It is “Can we restore the right systems, in the right order, within a timeframe the business can survive?”
Define what must come back first
List the processes that keep the business operating:
- Receiving calls and customer requests.
- Scheduling appointments or field work.
- Processing payments and payroll.
- Accessing contracts, client files, or patient information.
- Communicating with employees and customers.
- Producing invoices, shipping documents, or regulatory records.
For each process, define the maximum tolerable downtime and the maximum acceptable amount of lost data. These are business decisions. A practice that depends on same-day scheduling may need a different recovery sequence from an office that can operate manually for several days.
Use more than one kind of copy
CISA recommends maintaining offline, encrypted backups and regularly testing their integrity. An external drive left connected continuously is not meaningfully isolated if ransomware can access the user account or backup software. Cloud synchronization is useful for productivity, but synchronization can also replicate deletion or encryption.
A practical design may include:
- A production copy used for normal work.
- A versioned backup that can recover earlier file states.
- An isolated or offline copy protected from ordinary administrator access.
- A separate copy of critical configurations, license information, and recovery instructions.
The exact number and technology should reflect the business’s needs, budget, contracts, and risk. Immutable storage can help, but it must be correctly configured, monitored for cost, and evaluated against any applicable compliance requirements.
Protect the backup system itself
Backup administrators are high-value targets. Use MFA, separate accounts, least privilege, logging, and alerts for deletion, retention changes, unusual downloads, or changes to backup jobs. Do not allow every employee or ordinary workstation to administer backups.
Ask the backup provider:
- How are backup credentials protected?
- Can an attacker using a compromised administrator delete or encrypt all copies?
- Are backups encrypted in transit and at rest?
- How long are versions retained?
- Where are copies stored?
- What happens if the provider’s account or service is unavailable?
- Can the business restore without the provider’s immediate assistance?
Obtain the answers in writing and keep recovery information available offline.
Test restoration, not just backup jobs
A successful backup report proves only that a job completed. Schedule restoration tests for representative files and systems. Test the items most likely to be needed during a disruption:
- A shared folder.
- A customer or patient record, using appropriate safeguards.
- A finance or accounting database.
- A virtual machine or workstation image.
- A critical application configuration.
Record how long the restoration took, what permissions were preserved, what dependencies were missing, and who performed the work. Update the plan after every test.
Plan for a cloud outage
Cloud services can be unavailable because of account compromise, provider disruption, network failure, billing issues, or configuration errors. A continuity plan should identify alternate communication channels, manual workarounds, emergency payment procedures, and a way to reach customers.
Keep a current offline copy of critical phone numbers, vendor contracts, insurance information, software licenses, network diagrams, and recovery steps. Avoid printing more sensitive information than necessary, and secure physical copies.
If ransomware is suspected
- Disconnect affected systems from the network as quickly as practical.
- Do not casually power off every device; preserve evidence and follow the response plan.
- Call the designated IT or incident-response provider.
- Protect unaffected backups from further access.
- Preserve ransom notes, suspicious emails, logs, and screenshots.
- Contact legal counsel and the cyber insurer.
- Report the incident to law enforcement and consider notifying CISA.
- Do not assume that paying guarantees decryption or prevents data publication.
The 2025 FBI IC3 report recorded more than 3,600 ransomware complaints with reported losses exceeding $32 million. The report cautions that reported figures do not include every cost and reflect only incidents reported through IC3, so they should not be treated as a complete measurement of the problem.
Exercise the plan
Run a short scenario twice a year. Give participants a realistic disruption and ask them to make decisions without using the primary email system. Identify who approves recovery, who communicates externally, which systems are restored first, and what evidence must be preserved.
Business continuity is not a technical luxury. It is a decision framework that turns backups into usable recovery capability.
Human-reviewed draft. Guidance is general information, not legal advice.