| Recovery path | Typical outcome |
|---|---|
| Restore from tested, offline or immutable backups | Most reliable path; recovery time depends on backup size and how recently restores were tested, but data return is close to certain |
| Pay the ransom | In recent industry surveys, only about half of organizations that paid actually recovered their data in full, and payment funds further attacks |
| Attempt free public decryption tools | Occasionally successful for older, known ransomware strains with published decryption keys; unreliable for current or custom malware |
| Rebuild systems from scratch with no data recovery | Guarantees a clean environment but accepts total loss of unrecovered data; a last resort when backups do not exist or are also compromised |
Why Every Small Business Needs a Written Ransomware Recovery Plan
Ransomware does not wait for a convenient time. It typically detonates outside business hours, spreads through shared drives and connected backups within minutes, and puts whoever discovers it first under enormous pressure to make fast decisions with incomplete information. Businesses that have never written down a recovery plan tend to lose the most valuable resource during an incident: time. They spend the first critical hours figuring out who should be in charge, what to disconnect, and who to call, instead of executing a plan they already trust.
This playbook is organized the way a real incident actually unfolds: immediate containment in the first hour, a clear-eyed decision framework for the ransom payment question, a structured restoration process from backups, the legal and insurance notification steps most businesses forget, and the hardening work that happens after the immediate crisis passes. If your backup strategy is not yet solid, our step-by-step guide to securing your data in the cloud is a useful companion piece to read alongside this playbook, since a strong backup foundation is what makes most of this plan work at all.
Phase 1: The First 60 Minutes, Containment
The decisions made in the first hour after detection largely determine how the rest of the recovery goes. Speed matters, but so does not making the situation worse through panic.
- Isolate affected devices immediately. Disconnect infected machines from the network, physically if necessary, to stop lateral spread to shared drives, servers, and connected backups.
- Disable remote access and VPN sessions. Attackers frequently maintain remote access channels; cutting these prevents them from continuing to move through your systems while you respond.
- Pause backup synchronization, do not delete anything. Stop automated backup jobs from running so a compromised or encrypted state does not overwrite a clean backup, but preserve everything for later investigation.
- Notify your designated incident lead. Whoever is named in your incident response contact list takes charge of coordinating the next steps, so decisions are not made by multiple uncoordinated people at once.
- Do not power off infected machines unless instructed by a forensics professional. Powering off can destroy evidence in memory that helps identify the ransomware strain and how it entered, information that matters for both recovery and legal reporting.
- Take photos or screenshots of ransom notes and error screens. This documentation supports insurance claims, law enforcement reports, and identification of the specific ransomware variant.
The first-hour containment sequence
Detection triggers immediate network isolation of affected devices, followed by disabling remote access sessions and pausing (not deleting) backup jobs. The incident lead is notified and takes coordination authority. Ransom notes are documented before any further action, and infected machines are left powered on pending forensic guidance.
Phase 2: The Pay-or-Not-Pay Decision Framework
This is the most emotionally difficult decision in the entire playbook, and it should never be made alone or under pure time pressure. The FBI and most government cybersecurity agencies do not encourage paying a ransom to criminal actors, citing serious risks: payment does not guarantee data return, it funds future attacks, and paying can mark a business as a repeat target. In a recent industry survey of thousands of affected organizations, only about half of those who paid actually recovered their data in full, and the median payment ran into six figures.
| Factor | Leans toward not paying | Leans toward considering payment |
|---|---|---|
| Backup availability | Clean, tested, recent backups exist and can be restored | No usable backups exist or all known backups are also encrypted |
| Cost of downtime | Downtime cost is manageable during a restoration window | Every day of downtime causes severe, quantifiable revenue or safety loss |
| Data sensitivity | Lost data is recoverable or replaceable from other sources | Irreplaceable data (unique client records, safety-critical systems) is at risk |
| Legal and insurance guidance | Insurer or legal counsel advises against payment | Insurer, after full assessment, determines payment is the lower-risk path |
In practice, this decision should always involve your cyber insurance carrier and legal counsel before any payment is considered, both because many policies have specific requirements about how a ransom situation must be handled, and because payments to certain sanctioned groups can carry legal risk regardless of your business’s intent. Never treat this as a decision to make solely based on the ransom note’s countdown timer.
Common mistake
Some businesses assume that because backups exist somewhere, restoration will be quick and painless, only to discover during the actual incident that the backups were never tested, are also partially encrypted because they were connected to the network, or are missing recent data because backup jobs had silently been failing for weeks. Test your backup restoration process before an incident, not during one.
Phase 3: Restoring From Backups
Assuming backups are available and confirmed clean, restoration should follow a structured sequence rather than restoring everything simultaneously back onto a still-uncertain network.
- Confirm the backup is clean. Scan the backup itself for signs of the ransomware or dormant malware before restoring it, since some ransomware sits dormant for days or weeks before activating.
- Rebuild critical systems on isolated, verified-clean infrastructure first. Do not restore directly onto the compromised network until the original point of entry is identified and closed.
- Restore in priority order. Bring back the systems most critical to business operations first, based on a priority list ideally defined before any incident occurs.
- Reset all credentials before reconnecting restored systems. Assume any password or credential active at the time of the attack may be compromised, and rotate them all as part of restoration, not after.
- Monitor restored systems closely for reinfection. Watch for unusual activity for at least several weeks after restoration, since attackers sometimes leave backdoors that survive a basic restore.
What worked
Businesses that recovered fastest had already tested a full restoration of their most critical systems at least once before any real incident occurred, so the team already knew exactly how long restoration would take and exactly which steps could go wrong. That rehearsal removed most of the guesswork during the actual event and turned a potentially chaotic multi-day scramble into a calmer, largely mechanical process.
Phase 4: Legal, Regulatory, and Insurance Notification
Alongside technical recovery, a parallel set of notification obligations usually applies, and missing these deadlines can create legal exposure separate from the technical incident itself.
- Notify your cyber insurance carrier immediately, ideally within the timeframe specified in your policy, since delayed notification can affect coverage.
- Contact legal counsel to determine specific regulatory notification obligations that apply to your business type, location, and the kind of data involved.
- Report the incident to relevant law enforcement, which in many regions supports both investigation and, in some cases, access to known decryption keys for identified ransomware strains.
- Notify affected customers or partners if their data was compromised, following the specific timelines and language your legal counsel recommends.
- Document the full incident timeline as you go, since this record supports insurance claims, regulatory filings, and post-incident review.
For a detailed breakdown of exactly which notifications are legally required and on what timeline, see our companion guide on incident reporting obligations for small companies, since these requirements vary significantly by jurisdiction and industry.
Phase 5: Post-Incident Hardening
Once systems are restored and stable, the work is not finished. The same gap that let the attack in in the first place needs to be closed, or the same incident is likely to repeat.
- Identify and document the specific entry point used by the attacker, whether phishing, an exposed remote access service, or an unpatched vulnerability.
- Close that specific gap, and audit for similar gaps elsewhere in the environment.
- Review and strengthen backup architecture, specifically ensuring at least one copy is offline or immutable and untouched by the compromised network.
- Run a full password reset and credential audit across every account, not just the ones known to be directly affected.
- Update the incident response plan itself with lessons learned, since the plan used during this incident is now a tested, improved version rather than a theoretical document.
- Schedule a tabletop exercise within the next quarter to rehearse the updated plan before it is needed again.
Frequently Overlooked Steps in Ransomware Recovery
- Backup network isolationBackups connected directly to the production network are frequently encrypted along with everything else; true isolation is what actually protects them.
- Dormant malware after restoreSome ransomware variants stay dormant on restored systems and trigger again later; extended monitoring after restoration catches this before it repeats.
- Vendor and third-party credential rotationShared logins with vendors and contractors are commonly overlooked during a credential reset, leaving a path back in.
- Communication with employeesStaff need clear guidance on what to say to customers, press, or partners during the incident to avoid inconsistent or premature statements.
- Insurance policy fine printSome policies require using a pre-approved incident response vendor; engaging your own choice first can jeopardize reimbursement.
- Post-incident plan updateThe recovery plan itself should be revised based on what was actually learned, not left unchanged until the next incident exposes the same gaps again.
Glossary
- Ransomware
- Malicious software that encrypts a victim’s files or systems and demands payment, typically in cryptocurrency, in exchange for a decryption key.
- Immutable backup
- A backup copy that cannot be modified or deleted for a defined period, protecting it from being encrypted or destroyed even if an attacker gains administrative access.
- Lateral movement
- The technique attackers use to spread from an initially compromised device to other systems and shared resources across a network.
- Incident response plan
- A documented set of procedures defining roles, containment steps, communication protocols, and recovery actions for responding to a security incident.
- Double extortion
- A ransomware tactic where attackers both encrypt data and threaten to publicly release stolen copies of it, adding pressure beyond simple data loss.
- Tabletop exercise
- A structured, discussion-based rehearsal in which a team walks through a simulated incident scenario to test and improve a response plan before a real event occurs.
Key Takeaways
- Containment in the first 60 minutes, isolating devices, disabling remote access, and pausing backup jobs, largely determines how the rest of the recovery unfolds.
- The decision to pay or not pay a ransom should involve legal counsel and your cyber insurance carrier, never be made alone under time pressure.
- Government guidance generally discourages paying, since payment does not guarantee data return and funds further attacks.
- Restoring from tested, offline or immutable backups is the most reliable recovery path when those backups exist and are confirmed clean.
- Legal, regulatory, and insurance notification obligations run in parallel with technical recovery and carry their own deadlines and requirements.
- Post-incident hardening, closing the original entry point and updating credentials, is what prevents the same attack from succeeding again.
- A recovery plan that has never been rehearsed through a tabletop exercise is far less reliable than one that has been tested in advance.
FAQs
What is the very first thing to do when ransomware is discovered?
Immediately isolate the affected devices from the network, physically disconnecting them if necessary, to stop the ransomware from spreading further to shared drives, servers, and connected backups before anything else is done.
Should a small business ever pay a ransomware demand?
Government agencies generally discourage payment since it does not guarantee data recovery and funds future attacks. The decision should only be made after consulting legal counsel and your cyber insurance carrier, factoring in backup availability and the true cost of downtime.
How can I tell if my backups are safe from the ransomware?
Backups are safest when they are offline, immutable, or otherwise isolated from the production network, since backups directly connected to an infected network are frequently encrypted along with everything else during an attack.
Do I have to report a ransomware attack to law enforcement?
In many regions, reporting is strongly recommended and sometimes legally required depending on the type of data involved; law enforcement reporting can also provide access to known decryption keys for identified ransomware strains in some cases.
How long does ransomware recovery typically take?
Recovery time varies widely depending on backup size, how recently restores were tested, and the number of systems affected, ranging from a few days for a well-prepared business with tested backups to several weeks for one without a tested recovery process.
What is double extortion ransomware?
Double extortion is when attackers both encrypt your systems and steal a copy of your data, then threaten to publicly release the stolen data even if you restore from backups without paying, adding a second layer of pressure beyond data loss alone.
Should infected computers be powered off immediately?
Not unless instructed by a forensics professional; powering off can destroy evidence in memory that helps identify the ransomware strain and its entry point, information that matters for both recovery and legal reporting.
What should happen after systems are restored and running again?
Identify and close the original entry point the attacker used, reset all credentials, monitor restored systems closely for signs of reinfection, and update the incident response plan itself based on lessons learned from the incident.
References
- TierPoint, “Ransomware Recovery Plan: 5 Steps for 2026 Resilience”
- N-able, “Ransomware Recovery Playbook: A 10-Step Guide”
- Invenioit, “Should You Pay Ransomware Demands? Tips and Risks for 2026”
- GuidePoint Security, “To Pay or Not to Pay: The Ransomware Dilemma”
- SkyNet MTS, “Ransomware Recovery Plan for Small Business: Full Guide”
Strengthen the backup foundation this plan depends on with our guide to the 3-2-1-1-0 backup strategy explained with real tooling, review broader prevention priorities in our small business cybersecurity checklist, confirm your coverage matches this playbook using our overview of cyber insurance for small businesses, and lock down the network perimeter with our tutorial on securing your Wi-Fi network in 12 steps.
