iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A workable farm cyberattack plan is a written, offline-accessible playbook that assigns decision authority, maps both office IT and operational technology, protects people and animals, isolates compromised systems, keeps safe work going where possible, and restores verified backups. Build and exercise it before an incident; a generic ransomware checklist cannot define safe procedures for your particular pumps, feeding systems, irrigation, storage, or livestock.
This guide is U.S.-oriented. Adapt it to your farm’s equipment, staffing, contracts, insurer, state and local requirements, and professional legal and incident-response advice.
What the plan must achieve
An incident response plan is not just a list of antivirus steps. It coordinates safety, production continuity, technical containment, communications, evidence preservation, and recovery under time pressure. The plan should answer five questions immediately:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Who has authority to disconnect a computer, network segment, controller, or remote-access account?
- Which systems and processes are essential today, and what can be performed safely by hand or through an alternate system?
- How will workers report suspicious activity if email, phones, or the farm network are unavailable?
- Who contacts technical responders, equipment vendors, insurers, law enforcement, and sector resources?
- Which clean backups are restored first, and how will you verify that restoration is safe?
Write the plan for the farm you operate, not for an imaginary average farm. Include office systems such as accounting and payroll alongside operational technology (OT), including equipment controls, sensors, irrigation, climate systems, storage monitoring, and automated feeding where those exist. A compromise can move between business IT and production networks unless the boundaries and emergency procedures are understood in advance.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
CISA’s #StopRansomware Guide recommends maintaining and exercising an incident-response plan and a communications plan. Agriculture-sector guidance adds the need to connect office-IT planning with plant-floor and production systems, while preserving safe manual alternatives.
Build the plan before an incident
1. Assign roles and decision authority
Use named people and alternates, not job titles alone. Keep a printed copy and a digital copy on a device or storage medium that is not dependent on the farm’s normal network or email.
| Role | Required authority or duty | What to record |
|---|---|---|
| Incident lead | Activates the plan, sets priorities, approves containment and recovery decisions | Name, alternate, mobile and out-of-band contact |
| Operations and safety lead | Determines whether an equipment shutdown, manual process, or pause is safe | Areas covered, qualified backup, stop-work authority |
| Technical lead | Coordinates the IT provider, managed service provider, forensic specialists, and vendors | Provider contacts, contracts, remote-access details |
| Communications lead | Issues approved messages to workers, customers, suppliers, and service providers | Approved channels and message templates |
| Finance and fraud lead | Verifies payment, payroll, banking, and vendor-instruction changes | Independent verification contacts and approval limits |
| External liaison | Coordinates with the insurer, law enforcement, government, and sector resources | Policy number, claim route, agency and resource contacts |
State who may disconnect a workstation, disable a remote-access route, isolate a network segment, stop an automated process, authorize emergency purchases, and speak publicly. Include a succession rule if the primary lead is absent. A person who can perform a technical action is not automatically the person authorized to make the operational or safety decision.
2. Inventory systems and dependencies
Create an inventory that a responder can use during an outage. For every item, record its owner, location, business or production purpose, vendor, support number, software or firmware version when known, remote-access method, backup location, and dependencies.
- Business IT: email, identity accounts, accounting, payroll, banking access, farm-management software, file shares, customer and supplier portals, phones, and internet equipment.
- Production OT: tractors and implement systems, milking or feeding controls, irrigation pumps, greenhouse or barn climate controls, grain or cold-storage monitoring, access controls, cameras, sensors, and programmable controllers.
- Connectivity: cellular gateways, Wi-Fi, VPNs, vendor remote-support tools, radio links, cloud dashboards, and connections between office and production networks.
- Information: animal and crop records, treatment logs, planting and harvest schedules, environmental data, maintenance records, payroll, contracts, and shipping documents.
Draw a simple dependency map. For example, note whether a climate controller depends on a local network, cloud account, cellular connection, or vendor VPN; whether a sensor alert reaches a phone; and whether a manual reading can substitute for an unavailable dashboard. Mark systems whose failure can create a safety, animal-welfare, environmental, food-quality, or major financial consequence.
3. Define detection and reporting
Workers need one short, memorable reporting route that works when normal systems do not. Tell them to report an unexpected login prompt, locked or renamed files, a ransom note, unusual equipment behavior, missing records, repeated authentication failures, or a suspicious request to change bank or vendor details. The report should capture time, location, device or equipment involved, what the person saw, and whether anyone clicked, entered credentials, or disconnected anything.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Use a “report first, investigate second” rule. Workers should not delete messages, plug unknown USB devices into another computer, or attempt a self-directed cleanup. The plan should explain when a supervisor calls the incident lead and when the incident lead activates technical support.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →4. Plan safe continuity for each operation
For every critical activity, document a safe fallback and a stop condition. These are farm-specific decisions, not universal instructions.
| Activity to evaluate | Questions for the farm’s plan |
|---|---|
| Animal care and feeding | What feeding, watering, monitoring, and treatment tasks can be performed manually? How are quantities and observations recorded if the normal system is unavailable? |
| Irrigation and pumping | Can operators control the system locally? Who may switch it to manual mode or shut it down, and how will water, pressure, and environmental risks be checked? |
| Climate and ventilation | What local controls, alarms, generators, or human checks exist? At what temperature, humidity, or air-quality condition must the operation stop or escalate? |
| Harvest and storage | How are harvest timing, cooling, moisture, temperature, and stock records maintained without the dashboard? Which loss or quality thresholds trigger a pause? |
| Shipping and receiving | What paper or alternate process confirms loads, destinations, weights, and release authority if portals or email are down? |
| Records and payroll | Which paper forms or offline files capture essential entries until systems are restored, and who later reconciles them? |
Assign one person to authorize a shutdown or isolation that could affect people, animals, crops, product quality, or equipment. Include qualified alternates and emergency stop procedures already required by your equipment manuals and safety program.
5. Prepare communications that work offline
Maintain an out-of-band contact list: printed phone numbers, alternate email addresses, physical addresses, and a second way to reach each critical person. Include employees, the IT provider, equipment and software vendors, the insurer, legal counsel, law enforcement, emergency services, key customers and suppliers, and relevant government or sector resources.
Prepare short templates for:
- Internal notice: what happened, what workers must not do, where to report observations, and how the next update will arrive.
- Customer or supplier notice: which service or shipment is affected, what information is confirmed, and the approved contact route.
- Vendor-payment verification: a statement that bank, payroll, or account changes require voice verification through a previously known number.
- Technical escalation: incident time, affected systems, symptoms, actions already taken, and the farm’s safety constraints.
Name one spokesperson. Require independent verification before changing bank, payroll, supplier, or customer payment instructions, especially when a request arrives by email during an incident.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Design backups that can actually restore the farm
The 3-2-1 baseline
Food and Ag-ISAC describes the 3-2-1 principle: keep at least three copies of important data, on two different types of media, with one copy completely offline. The offline copy must be disconnected when it is not being updated; a backup drive permanently attached to a compromised computer is not an offline backup.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
| Arrangement | What it provides | Weakness |
|---|---|---|
| One copy on the production computer | Convenient day-to-day access | Ransomware, hardware failure, or theft can remove the only copy |
| Several copies on the same network | More copies, faster access | A single compromise may encrypt or delete them all |
| 3-2-1 with an offline copy | Copies on different media and a copy isolated from network compromise | Requires disciplined rotation, protection, and restoration tests |
A suitable external hard drive can serve as one offline medium, but capacity, encryption, file-system compatibility, durability, and rotation frequency depend on the farm’s data and equipment. Disconnect it when not in use. A drive by itself is not a backup program: label it, protect it from damage and unauthorized access, record what it contains, and maintain other copies.
Test restoration, not just backup completion
Schedule restoration tests. Select representative files and, separately, a complete system or application recovery when the vendor supports it. Document how long restoration took, which credentials or license keys were needed, whether records were complete, and who approved the recovered system for production use. Test an offline copy without reconnecting potentially infected equipment to the restored environment.
Set a recovery order before an incident. A typical order might begin with identity and network services, then safety-critical monitoring or controls, then records needed for animal, crop, storage, and shipping decisions, followed by ordinary office applications. The correct order for your farm depends on its hazards and dependencies; write it down with the operations and safety lead.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsWhat to do when an attack is suspected
- Protect people and operations first. If equipment behaves dangerously or a process becomes unsafe, use established emergency procedures and contact the operations and safety lead. Do not take a technical action that creates a physical hazard.
- Report and activate. The observer records what happened and contacts the designated route. The incident lead opens an incident log, notes the time, and activates the plan when suspicion is reasonable; waiting for perfect proof can increase damage.
- Identify the apparent scope. List affected devices, accounts, applications, network segments, controllers, unusual messages, and the last known normal time. Ask whether a vendor account, remote-access tool, or cloud service is involved.
- Isolate affected systems. Follow the plan to disconnect a device or isolate a network segment at the appropriate level. If OT is involved, the authorized operations lead and qualified technical responder must coordinate the action so isolation does not create a safety or animal-welfare failure. Preserve a safe way to monitor critical conditions.
- Do not destroy evidence. Do not wipe, factory-reset, reformat, or restore a machine merely to make the message disappear. Do not reconnect isolated equipment to “see if it works.” Preserve ransom notes, timestamps, logs, suspicious emails, and device details for qualified responders, consistent with safety and legal advice.
- Protect accounts and communications. Use the out-of-band contact list. Through a clean device and with technical guidance, secure compromised credentials and remote-access paths. Treat unexpected requests to change payment or vendor instructions as fraudulent until independently verified.
- Maintain only approved continuity work. Use the documented manual or alternate procedures. The incident lead and operations lead decide what continues, what pauses, and what must stop.
- Call qualified assistance. Contact the IT provider or incident-response specialist, relevant equipment vendors, the insurer if applicable, and law enforcement or government resources as appropriate. Give responders the incident log and the farm’s safety constraints.
- Decide on recovery deliberately. After responders assess containment and persistence, restore from known-clean backups in the documented order. Change affected credentials, close the entry path, validate system behavior, and obtain operations approval before returning equipment or processes to normal.
- Record lessons and obligations. Preserve a timeline of decisions, costs, downtime, communications, and restored systems. Review contractual, insurance, privacy, regulatory, and reporting duties with qualified counsel and the relevant authorities.
Do not assume that paying a ransom guarantees decryption, removes an attacker’s access, or satisfies legal and insurance requirements. Any payment decision requires the farm’s leadership, insurer and legal advisers, and appropriate authorities.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Escalation contacts to maintain
Recheck this list whenever the plan is reviewed; phone numbers, eligibility rules, contracts, and reporting channels change.
- Internal: incident lead, alternates, operations and safety leads, farm owner or board, finance lead, and communications lead.
- Technical: IT provider or managed service provider, internet and cellular providers, cloud-service support, cybersecurity incident responders, and equipment and software vendors.
- Business and legal: insurer and breach-response contacts, legal counsel, payroll and banking contacts, key suppliers, customers, and logistics partners.
- Public and sector: local law enforcement, applicable emergency-management contacts, CISA assistance channels, USDA or FSIS resources where relevant, and Food and Ag-ISAC resources. CISA describes voluntary federal assistance for affected entities; Food and Ag-ISAC describes incident-specific alerts and member requests for assistance.
Record whether a contact is available 24/7, what information it needs, and whether a contract or membership is required. Confirm the route during an annual review rather than discovering an expired number during an outage.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
Exercise the plan and keep it current
Run a practical tabletop
Choose a scenario that reflects your inventory: an encrypted office computer, a compromised vendor account, loss of remote access to a controller, or a ransomware note on a file server. Include the people who would actually make decisions. Ask them to find the offline plan, reach contacts without farm email, identify affected systems, choose safe continuity actions, and explain which backup would be restored first.
After the exercise, record each gap, an owner, a due date, and the evidence that will show it is fixed. A plan that cannot be found, understood, or used under pressure is not operationally ready.
Review triggers and schedule
- Review at least annually and after a real incident or exercise.
- Update after installing equipment, changing a vendor, adding remote access, moving workloads to the cloud, or changing farm ownership or staffing.
- Revalidate backup restoration after major software or controller changes.
- Remove departed workers’ accounts and update alternates and emergency numbers.
- Check that printed copies, offline storage, keys, chargers, and paper forms are accessible at the locations where decisions may be made.
A one-page readiness check
- Primary and alternate incident leads are named, reachable, and authorized.
- Operations, safety, technical, communications, finance, and external-liaison duties are assigned.
- Office IT, OT, remote-access routes, vendors, owners, and dependencies are inventoried.
- Workers know exactly how to report suspicious activity.
- Safe manual or alternate procedures exist for animal care, irrigation, climate, harvest, storage, shipping, and essential records where applicable.
- An out-of-band contact list and approved message templates are available offline.
- Backups follow the 3-2-1 principle, include an offline copy, and have passed restoration tests.
- The response plan states what must be isolated, who may authorize it, and what must not be wiped or restored prematurely.
- Technical, vendor, insurer, law-enforcement, government, and sector contacts have been verified.
- A tabletop exercise has tested decisions, communications, continuity, and recovery.
What the incident numbers do—and do not—tell you
Food and Ag-ISAC reported 6,377 tracked ransomware incidents across sectors in 2025, including 265 tracked incidents in food and agriculture, in its 2026 sector review. These are tracked figures, not a complete census and not a count of farms alone; unreported or unobserved incidents may be missing. They are useful for showing that agriculture is included in ransomware activity, not for predicting the likelihood of an attack on a particular farm.
A 2021 joint CISA, FBI, and NSA advisory described BlackMatter ransomware incidents involving two U.S. Food and Agriculture Sector organizations. That historical example demonstrates sector relevance, but it is not current threat intelligence and should not be treated as a forecast.
Legal and jurisdictional limits
There is no single reporting deadline or universal notification rule for every farm. Duties can depend on location, the type of information involved, contracts, insurance terms, food or environmental regulation, and whether employees, customers, or other parties are affected. Confirm obligations with qualified counsel, your insurer, law enforcement, and relevant authorities when tailoring the plan.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
