The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The most reliable ransomware plan combines several protected copies of critical data, at least one copy kept offline and encrypted, and restore drills that prove the files and systems can come back. If an attack occurs, isolate affected devices first, preserve clean recovery environments, investigate possible data theft separately, and restore the services the business needs most in a deliberate order.
What a ransomware-ready backup plan must accomplish
Ransomware can encrypt files, disrupt applications and attempt to reach backups that are connected through the same network or administrator account. A backup that exists but can be deleted, encrypted or never restored is not a recovery plan. CISA’s joint #StopRansomware Guide with the FBI, NSA and MS-ISAC (September 2023) states: “Maintain offline, encrypted backups of critical data, and regularly test the availability and integrity of backups in a disaster recovery scenario.”
For a small business, the plan has four outcomes:
- Critical records and systems are identified before an emergency.
- Copies are separated from normal user and administrator access, with at least one encrypted copy offline.
- Restore procedures, software, credentials and system information are available to rebuild the business.
- People know how to contain an incident and restore services without reintroducing malware.
This is operational guidance, not a guarantee that every file can be recovered or a replacement for incident-response, legal or regulatory advice tailored to your business.
Start with an inventory and recovery priorities
List every place business data lives
Create an inventory of desktops and laptops, servers, phones or tablets used for work, cloud services, shared drives, line-of-business applications, email, accounting platforms, customer records, contracts, production files and security devices. Record the owner, location, administrator account, data held and backup method for each item. Include information stored by a supplier or cloud application; a service being “in the cloud” does not by itself establish that you have an independent, restorable copy.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Protect the inventory and recovery documentation as carefully as the data. Keep an offline copy where practical so an attacker who compromises ordinary accounts cannot erase the instructions needed to rebuild systems.
Rank services by business consequence
Identify what the business must restore to take orders, serve customers, pay staff and meet essential obligations. Rank services by the harm caused by downtime and by the dependencies they require. For example, a customer-order database may depend on a particular application, server configuration, licensing record and credentials. Restoring the database file alone may not make it usable.
Write the order in which services should return, who approves each step and what temporary workaround is acceptable. This turns “restore everything” into a sequence that can be followed when staff are under pressure.
Recommended Free Tools
Design copies that ransomware cannot reach easily
Keep an offline, encrypted copy
An external hard drive can provide a practical physical copy when it is encrypted and disconnected after each backup session. A drive left plugged into a computer or network is still exposed: malware may encrypt its contents or a compromised administrator may delete them. Connect it only for the backup or restore operation, then disconnect it and store it securely.
Offline does not mean unprotected. Use encryption, restrict who can unlock the device, label it for the correct business and protect it from theft, fire and water. Maintain more than one rotation of removable media so a newly damaged or infected copy is not the only offline version.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Use separately controlled copies for convenience and scale
A NAS or cloud repository can simplify shared backups and faster restores, especially where several computers produce local data. However, a reachable NAS is not automatically an offline backup, and a cloud account controlled by the same compromised administrator may be vulnerable. Apply separate credentials, least-privilege access, multifactor authentication where available, network segmentation, version history and delete protection. Keep an independent copy outside the same administrative boundary.
Immutable storage can prevent alteration during its retention period and may strengthen protection against ransomware. CISA also warns that configuration mistakes can create significant cost and that immutable storage may not satisfy every regulatory requirement. Confirm retention behavior, deletion controls and compliance fit before relying on it.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesUnderstand the 3-2-1 rule’s status
The CISA material used here supports multiple separate copies and offline protection; it does not establish a universal CISA requirement called “3-2-1.” A separate CISA advisory result attributes that approach to the Australian Cyber Security Centre. You may use 3-2-1 as an internal design shorthand, but document the actual copies, locations, access controls and restore tests rather than treating the label as proof of protection.
Choose a mix of backup approaches
| Approach | Protection characteristic | Operational strengths | Important exposure or limitation |
|---|---|---|---|
| Removable encrypted drive | Offline when disconnected between sessions | Physical control and a straightforward path to a separate copy | Connected drives are exposed; rotation, secure storage and manual handling are required |
| NAS or other local repository | Usually network-reachable unless deliberately isolated | Convenient shared storage and potentially quick local restores | Ransomware or a compromised administrator may reach it; segmentation and access controls are needed |
| Cloud repository | Separately hosted, but still dependent on account and service controls | Off-site storage, version history and access from multiple locations | Account compromise, deletion permissions, configuration and provider recovery behavior must be controlled |
| Immutable storage | Copies are protected from alteration for a defined retention period | Can resist deletion or encryption during that period | Misconfiguration can be expensive, and the arrangement may not meet every regulatory requirement |
Compare candidate designs on offline or separate control, the ability of ransomware or a compromised administrator to delete copies, encryption and access control, restore speed, age of the newest usable restore point, retention and version history, system and application coverage, operating and storage cost, maintenance effort and compatibility with contractual or industry obligations. Many small businesses combine a removable offline copy with a separately controlled cloud or immutable copy rather than relying on one method.
Set backup frequency and retention from business tolerance
Choose a recovery-point objective
Ask how much recent work the business can afford to lose. If losing one day’s orders is unacceptable, a daily job is not enough; schedule copies often enough to stay within that limit. If a few hours of transactions can be recreated, a less frequent schedule may be reasonable. CISA emphasizes frequent backups and regular restoration testing but does not prescribe one schedule for every small business.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
Keep useful historical versions
Retention must cover more than the newest copy. Ransomware may remain unnoticed while files are quietly changed, so preserve versions old enough to precede the compromise. Define how long daily, weekly or monthly points remain available, then verify that the chosen repository actually enforces those periods and cannot be shortened by an ordinary user.
Back up systems, not only documents
For critical services, retain system images or dependable build information in addition to application data. Keep installers, configuration exports, license details, encryption keys, service accounts and recovery codes in protected locations. Record dependencies such as DNS, identity, database engines, line-of-business software and integrations. A readable file is not a working service until the software and configuration that interpret it are restored.
Implement the plan step by step
- Assign ownership. Name a person responsible for backup jobs, another for approving restores and a substitute for each role. If there is no internal IT staff, a managed service provider can help define coverage, retention and restore exercises; verify the provider’s responsibilities and access controls in writing.
- Document the inventory and priorities. Record assets, data owners, dependencies, recovery order and acceptable data loss or downtime for each critical service.
- Configure protected destinations. Encrypt removable media, create separate accounts, enable multifactor authentication where supported, restrict deletion rights, enable versioning or delete protection and segment backup systems from ordinary workstation traffic.
- Run an initial full backup. Confirm that every priority system and dataset is included, that the job completes without errors and that the resulting copy can be located without relying on an infected computer.
- Schedule recurring copies and rotate offline media. Follow the frequency chosen from the business’s tolerable data loss. After a removable drive finishes, disconnect it and store it securely; keep another rotation available so one copy is not a single point of failure.
- Protect the recovery information. Store the inventory, restore instructions, system images, software, licenses, credentials and encryption-key procedures in a protected location with an offline version where practical.
- Test a representative restore. Recover individual files and at least one complete critical service in an isolated environment. Check that files open correctly, permissions are sensible, applications run, integrations work and staff can resume the required process.
- Record results and correct gaps. Note elapsed time, missing software, expired credentials, unreadable files and any step that depended on an unavailable person. Update the plan and repeat the exercise after major system or supplier changes.
What to do when ransomware is suspected
1. Isolate impacted systems
Use the established incident-response plan if one exists. Disconnect affected computers, servers and network segments as needed to stop spread. Do not keep using a visibly compromised device to administer backups or recovery systems. Preserve relevant evidence and note what was observed, when it began and which accounts or systems were involved.
2. Protect clean recovery resources
Do not connect an unverified device to the machines or networks from which you plan to recover. Use clean systems, clean installation media and separate administrative credentials. Keep offline backup media disconnected until the recovery team has identified the safe restore point and the destination has been prepared.
3. Determine what can be restored
Review available versions for signs of corruption or unauthorized changes. Select a restore point that predates the compromise, then validate it in an isolated environment where possible. Confirm that the backup includes the application, configuration and credentials needed to make the data useful, not just a folder of files.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
4. Restore by business priority
Bring back the services identified during planning: for example, the systems needed to take orders, serve customers, pay staff or meet essential obligations. Restore dependencies before the applications that rely on them. Keep recovered systems separated until monitoring and security checks show they are safe to reconnect.
5. Treat possible data theft as a separate problem
Successful file recovery does not prove that attackers did not copy sensitive information. Ransomware operations may combine encryption with exfiltration and threats to publish stolen data. Investigate the possibility of exposure, preserve evidence and obtain appropriate legal, regulatory, insurance and communications advice about notifications and customer or employee contact.
6. Reconnect cautiously and learn from the event
Reconnect systems in a controlled order after they are rebuilt or cleared, with monitoring and least-privilege accounts in place. Document the timeline, affected assets, restore results and decisions. Change the backup design, credentials, segmentation or training that failed, and schedule a new restore exercise to verify the fixes.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common mistakes that make backups fail
- Leaving the only copy attached: a connected external drive or reachable NAS can be encrypted along with production data.
- Using the same administrator everywhere: one stolen credential can expose production systems and backup deletion controls.
- Backing up files without their application context: databases, accounting systems and specialized software may require images, installers, licenses and configuration.
- Never performing a restore: a successful job log does not show that files are readable or that a service can return to operation.
- Keeping only the newest version: an undetected compromise may already be present in that version.
- Restoring directly into an infected environment: malware can reinfect clean data or newly rebuilt systems.
- Assuming recovery ends the incident: stolen data, regulatory duties, contractual commitments and communications may remain unresolved after decryption or restoration.
When outside help is justified
A small business does not need a large security department to establish these controls, but it does need accountable ownership and time for testing. Consider a qualified managed service provider when staff cannot inventory all systems, configure separate access, maintain offline rotations or conduct an isolated restore. Ask the provider to specify what is covered, how credentials are separated, who owns the copies, how often restores are tested, how long versions are retained and how an emergency handoff works. Keep an internal copy of the inventory and recovery instructions so the business is not dependent on one individual or supplier.
Quick Recap
Minimum operating checklist
- Critical systems, data and dependencies are inventoried.
- Recovery order and acceptable data loss are documented.
- At least one encrypted copy is offline and disconnected between backup sessions.
- Other copies are separately controlled with restricted deletion rights and version history.
- System images or build information, software, licenses and recovery credentials are available.
- Representative file and full-service restores are tested regularly.
- Incident instructions begin with isolation and protect clean recovery environments.
- Potential data exfiltration is investigated separately from file restoration.
- Lessons from tests and incidents are recorded and used to update the plan.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
