Can Your Business
Restore After Ransomware?

Backup does not prevent ransomware

Backup is part of recovery planning. It is not a ransomware shield.

Small businesses still need basic security controls, patching, account protection, staff awareness, endpoint protection, and an incident response plan. But once files are encrypted, deleted, corrupted, or overwritten, backup quality becomes the operational question: can the business restore a clean, useful version of critical data without guessing?

What ransomware can do to backup plans

Readiness is harder than “we back up files.” Common failure points:

• Backups are stored on the same computer that gets encrypted.
• Backup drives are always connected and reachable.
• Cloud-synced folders copy encrypted files quickly.
• The latest backup contains the damaged version.
• Backup failures go unnoticed for weeks.
• Nobody knows how long restore will take.
• Accounting, client, estimate, photo, payroll, and tax folders are scattered across devices.
• No one has tested a restore before the emergency.

The goal is to find those problems before ransomware or hardware failure does.

The readiness checklist

• Critical files are identified by business function.
• Files are backed up outside the daily working computer or synced folder.
• Backup copies are protected from ordinary user access.
• At least one recovery path is not easily overwritten by normal file changes.
• Backups are encrypted, and backup jobs are monitored.
• Failed backups create an alert or review item.
• Several previous versions are retained.
• Restore has been tested recently.
• The business knows who starts recovery and which files get restored first.
• Recovery instructions are documented somewhere accessible during an outage.

If several answers are unclear, the business probably has a backup assumption instead of a restore plan. CISA describes the 3-2-1 rule, three copies, on two types of media, with one offsite; the useful point for a small business is separation.

What to restore first

Decide before an incident, not during one. Priority usually starts with:

• Accounting and billing data.
• Customer records and active job files.
• Current estimates, contracts, and work orders.
• Payroll and tax documents.
• Operational spreadsheets and daily shared folders.
• Photos, scans, or documents required to finish open work.