Start with the 3-2-1 backup rule
The 3-2-1 backup rule is a useful foundation: keep three copies of important data, on two different types of storage or media, with at least one copy stored offsite. The point is not to collect backups for their own sake. It is to create more than one path back to a usable version of your files if a computer, account, office, or network is compromised.
Begin by listing what the business must recover first. That may include accounting records, customer orders, contracts, project files, website assets, shared documents, and configuration information. Assign an owner to each data set and decide how much recent work you can afford to lose. A backup that runs often but excludes the files you need is not a dependable recovery plan.
- Inventory critical files, applications, and accounts.
- Confirm backup frequency matches the cost of lost work.
- Document where each backup copy is stored.
- Separate backup administration from everyday user access.
Keep at least one recovery copy offline or isolated
A backup that is permanently connected and reachable with the same credentials as your production systems may be encrypted or deleted during a ransomware event. An offline copy is disconnected when not being updated. An isolated or otherwise access-restricted copy serves a similar purpose by limiting how far an attacker can move through your environment.
Offline does not automatically mean useful. Label copies clearly, protect them from accidental deletion, and establish a schedule for updating them. For cloud-based systems, review retention, version history, deletion protection, and administrator permissions rather than assuming a provider’s standard sync feature is a backup. Sync can reproduce unwanted changes; recovery requires historical, intact versions.
- Check whether users can delete all backup versions.
- Use separate administrative credentials where possible.
- Review retention and version history settings.
- Test recovery from the isolated or offline copy.
Use MFA and reduce account exposure
Multi-factor authentication, or MFA, adds a second verification step beyond a password. Enable it first on email, administrator accounts, financial services, cloud storage, domain management, remote access, and any service that can reset other passwords. These accounts have a larger blast radius because access to them can expose data or unlock other systems.
MFA works best alongside basic account hygiene. Remove former users, avoid shared administrator logins, use unique passwords, and keep recovery methods current. Store backup codes securely and make sure more than one trusted person can follow the recovery process without turning those codes into a shared, uncontrolled secret.
Prioritize accounts that control backups and identity. If an attacker can sign in as a backup administrator or reset the email account that receives security alerts, strong protection on ordinary user accounts will not be enough. Review sign-in alerts and permission lists periodically so unusual access is easier to spot.
- Enable MFA on email and administrator accounts first.
- Remove inactive users and unnecessary privileges.
- Use separate accounts for daily work and administration.
- Confirm account recovery details are current.
Patch the systems ransomware can reach
Patching closes known weaknesses in operating systems, browsers, applications, network equipment, and business software. It is not enough to update one office computer while leaving a remote-access tool, file server, router, or employee laptop behind. Make a simple inventory of internet-facing and business-critical systems, then assign someone to check updates and restart devices when required.
A practical patching routine should distinguish urgent security updates from ordinary feature updates without becoming an administrative project nobody follows. Enable automatic updates where appropriate, but still verify that updates completed. Unsupported software deserves special attention because it may no longer receive fixes. If replacement is not immediate, limit its access and document the temporary risk.
Patching also reduces uncertainty during an incident. When you know which systems exist, who manages them, and when they were last updated, you can make faster decisions about isolation and restoration. Keep a basic record of exceptions instead of allowing outdated systems to disappear from view.
- Maintain an inventory of devices, applications, and remote access tools.
- Turn on automatic updates where they are appropriate.
- Verify updates completed on laptops and critical systems.
- Replace or isolate unsupported software.
Write and rehearse an incident response plan
A ransomware plan should answer practical questions before an emergency: who can disconnect a device, who manages accounts, who contacts your IT or security provider, who communicates with employees and customers, and who decides when systems can return to service. Include contact details outside the affected systems so the plan remains available if email or shared storage is inaccessible.
If you see suspicious encryption, ransom notes, unexpected account activity, or missing files, avoid rushing to restore over the top of potentially affected systems. Disconnecting a compromised device from networks may help limit spread, but preserve useful information and seek qualified incident-response guidance. Do not assume that paying resolves the underlying access or guarantees recovery.
Test the plan with a short tabletop exercise. Pick a realistic scenario, such as an administrator account being locked out or a shared folder becoming unreadable, and walk through the first hour. The exercise exposes missing credentials, unclear authority, unavailable phone numbers, and backup assumptions while the cost of finding those gaps is still low.
- Keep an offline copy of emergency contacts and procedures.
- Define who can isolate devices and disable accounts.
- List backup restoration priorities and decision-makers.
- Run a short tabletop exercise at least when major systems change.