The Small-Business Ransomware Readiness Check

A ransomware conversation should start with business impact, not a frightening headline. What systems would stop bookings, payroll, shipping, or customer communication? Which files are irreplaceable? Who needs to know first? Answering those questions creates a priority list that technology can support.

Keep offline or separately protected backups, patch internet-facing systems, use MFA, and limit administrative access. Ask vendors how they notify customers and how a restore works. Practice a short tabletop scenario without touching production: identify the decision maker, the communication channel, and the first safe step.

No checklist eliminates risk. It does make the response less dependent on a single person’s memory. Review the plan when the business adds a payment system, a new remote worker, or a new cloud tool.

Begin with interruption, not fear

Ransomware readiness is a business continuity exercise. Ask which systems would stop bookings, payroll, dispatch, shipping, customer communication, or access to the website. Identify irreplaceable records and the person who can make a shutdown decision. For an island operation, include the possibility that staff, vendors, and customers cannot reach one another normally. A short priority list is more actionable than a frightening collection of headlines.

Run a quiet diagnostic

Check patch ownership, administrator accounts, MFA, endpoint protection, remote access, backup separation, and vendor contacts. Confirm that backups include the data the business actually needs and that an attacker who controls the application account cannot delete every copy. Ask staff how they would report a suspicious attachment or locked screen. The aim is to reveal ambiguity before an incident makes every choice urgent.

Practice a tabletop scenario

Use a fictional morning when the booking system is unavailable and a shared drive shows an unfamiliar message. Do not click real malware or alter production. Have the team identify the first safe action, who disconnects a device, who contacts the provider, who communicates with customers, and how evidence is preserved. Write down decisions that required an owner or a phone number not in the plan.

Example: a seasonal retailer

A Hawaiʻi gift shop may rely on point of sale, an online catalog, and an email account during a busy visitor season. Its fallback might include a paper order form, a separate phone line, a clean exported product list, and a prewritten customer notice. Those measures do not replace technical controls, but they reduce pressure while the team confirms what is safe to restore.

Metrics and boundaries

Measure patch age for exposed systems, MFA coverage, backup restore time, percentage of critical vendors with a current contact, tabletop completion, and time to make a customer-facing decision. These are preparedness indicators, not probabilities of avoiding an attack. No article can determine legal reporting duties or an appropriate ransom decision. Involve qualified incident-response, legal, and law-enforcement contacts when the facts require them.

Common failures and sources

The usual failures are backups that remain writable from the production account, plans that name no decision maker, and staff who fear reporting a mistake. Avoid promising that one product makes a business ransomware-proof. CISA’s ransomware guidance and NIST’s Cybersecurity Framework are strong starting points; adapt them to the systems, vendors, and geography the team actually operates.

Field note

Keep the tabletop short enough to repeat. A thirty-minute conversation that identifies the first safe action, the decision maker, and the customer message is more valuable than a large plan no one rehearses. Record uncertainties without assigning blame, then close the highest-impact permission or backup gap before the next exercise.

Primary references: CISA: StopRansomware · NIST Cybersecurity Framework 2.0