iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
For most small businesses, use both endpoint protection and accountable IT operations. Endpoint detection and response (EDR) or centrally managed antimalware can block and investigate activity on devices, but neither one automatically secures accounts, patches every system, protects backups, or runs recovery. A managed IT provider can supply the people and processes for those jobs, yet outsourcing introduces provider-access and supply-chain risk.
The practical goal is not to buy a label. It is to assign every ransomware control to an owner, verify that it works, and document what happens when an alert or outage occurs.
What each option actually covers
Ransomware protection is a layered program. CISA’s #StopRansomware Guide, issued jointly with the FBI, NSA and MS-ISAC and updated in September 2023, places endpoint tools alongside multifactor authentication (MFA), patching, least privilege, secure configuration, protected backups and incident response. No single product or service replaces those layers.
| Decision | What it can provide | What you still must verify |
|---|---|---|
| Endpoint security alone | Centrally managed antimalware, EDR telemetry, blocking and alerting on covered devices | Alert monitoring, patching, account security, backup isolation, restore testing and incident coordination |
| Managed IT alone | Administration and support capacity, potentially including patching, backups, MFA and response | The contract’s exact controls, security expertise, after-hours coverage, provider access and recovery obligations |
| Both layers | Technical endpoint controls operated by an assigned internal team or provider, with broader preventive and recovery controls | Clear ownership, integration between alerts and response, and evidence that each control is maintained and tested |
Endpoint security is a technical layer, not a complete program
EDR records process, file and network behavior so an operator can investigate suspicious activity and isolate a device. Centrally managed antivirus provides policy enforcement and malware detection across enrolled endpoints. Application allowlisting can restrict execution to approved software where the business can maintain an accurate application inventory.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
These controls matter only when the relevant laptops, desktops and servers are enrolled, policies are maintained, and alerts reach someone who can act. An unmonitored alert queue is not an incident-response capability. A tool that covers office computers but not a file server, administrator workstation or remote laptop leaves a path for attackers.
Managed IT supplies capacity, not an automatic security guarantee
A managed service provider (MSP) may administer operating systems, cloud services, identity settings, backups and user support. The term “managed IT” does not establish that EDR, 24/7 alert response, secure backups, recovery testing or incident response is included. Request a control-by-control scope rather than relying on the service category.
CISA warns that MSPs can become a ransomware infection vector because they hold privileged access to multiple customers. The provider’s own cyber hygiene, remote-management tools, authentication and separation between customers therefore become part of your risk assessment.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Why both layers are usually the sensible model
Small businesses often lack staff to tune endpoint policies, investigate alerts, patch systems, maintain backup copies and coordinate recovery. Combining endpoint controls with an accountable internal person or contracted provider addresses that capacity gap. The arrangement is effective only when responsibilities are written down: who configures a policy, who receives an alert, who can isolate a device, who approves restoration and who contacts leadership.
This is a practical application of CISA’s layered guidance, not a claim that every company needs the same provider or operating model. A business with a capable internal IT and security team may operate both layers itself; another may contract for selected services while retaining control of identity, backups and incident decisions.
Controls every small business should put in place
1. Build and maintain an endpoint inventory
List laptops, desktops, servers, virtual machines and other systems that process or store business data. Record the operating system, owner, location, critical applications and whether the device is enrolled in central management. Include remote workers’ devices and systems hosted by a cloud or colocation provider.
Use the inventory to find gaps: an unprotected server, a former employee’s still-active laptop or a device that stopped checking in. Set a review cadence and remove retired devices and accounts from management systems.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
2. Centrally manage antimalware and EDR
Deploy centrally administered antimalware on every supported endpoint and consider EDR or application allowlisting for systems where the risk and operational effort justify it. Configure protections against tampering, define who can change policies and route high-severity alerts to a monitored channel.
- Specify which events require immediate isolation, such as ransomware-like file changes or credential theft indicators.
- Record the responder, time, action taken and affected device for each significant alert.
- Confirm that isolation does not destroy evidence needed for investigation and that critical services have a recovery path.
3. Require MFA for important accounts and services
Enable MFA for email, file storage, remote access such as VPN or remote desktop gateways, administrator accounts and any service that can reach critical systems. CISA’s small-business guidance specifically recommends working with the IT provider to enable MFA across email, file storage and remote access.
Use separate administrator accounts, protect recovery codes, remove stale users promptly and review sign-in logs for impossible travel, unfamiliar devices or repeated failures. MFA reduces the value of a stolen password but does not replace patching or endpoint controls.
4. Patch and harden systems
Keep operating systems, applications, network appliances and internet-facing services updated. Prioritize vulnerabilities on systems exposed directly to the internet, remote-access infrastructure and software that handles sensitive data. Track exceptions with an owner and a deadline rather than allowing indefinite deferral.
Recommended Free Tools
Disable unnecessary services and ports, remove unsupported software, and apply secure configuration baselines. Use least privilege so ordinary users and service accounts cannot install software or modify security settings without an approved administrative path.
5. Protect backups from the attack path
Maintain backups of critical data that attackers cannot readily reach or encrypt. CISA recommends offline, encrypted backups and regular tests of their availability and integrity. Keep at least one protected copy disconnected from ordinary user and administrator credentials, and control who can reconnect or delete it.
An external hard drive can serve as an offline storage medium when it is encrypted, disconnected after the backup, stored securely and rotated. Buying a drive alone does not prevent ransomware or guarantee recovery. Define a rotation schedule, label copies, protect the encryption keys and test restoration to a separate system.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
Document recovery priorities: for example, identity services and financial records may need restoration before less critical archives. A backup job that reports “successful” is not proof that files can be restored; perform test restores, check file integrity and record the result.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
6. Prepare incident response before an incident
Keep a short response plan with internal decision-makers, the IT or security contact, legal and communications contacts, insurance requirements if applicable, and instructions for preserving evidence. Define who may disconnect a device, disable an account, contact law enforcement or approve rebuilding systems.
CISA’s response materials include a checklist, and CISA’s StopRansomware Services page lists no-cost scanning and testing services. Availability can change, so confirm current offerings when you plan an exercise. Run a tabletop scenario that starts with one encrypted laptop and tests escalation, account containment, backup access and recovery priorities.
How to evaluate an MSP or managed security arrangement
Ask for written answers and attach the final scope, service levels and security requirements to the contract. Vague assurances such as “we monitor your environment” are not enough.
- Define the covered environment. Identify every covered device, server, cloud service, network, user account and remote location. State what is excluded and how an addition is enrolled.
- Define endpoint operations. Confirm whether antimalware and EDR are included, which policies are enforced, how quickly alerts are reviewed, and whether response is available outside business hours.
- Define patch responsibility. Specify who approves, deploys and verifies operating-system and application updates, how emergency patches are handled, and how exceptions are reported.
- Define identity controls. State who configures MFA, reviews privileged accounts, enforces least privilege and removes access when an employee leaves.
- Define backup ownership. Identify the data covered, the storage locations, encryption, offline or immutable copies, retention, deletion protections, recovery-point objectives and restoration frequency. State who owns the accounts and encryption keys if the relationship ends.
- Define incident roles. Set notification deadlines, containment authority, evidence-handling duties, communications responsibilities and recovery leadership. Include what happens if the provider itself is compromised.
- Define access and logging. Limit provider privileges to systems within its role, require MFA for provider staff, log remote sessions and retain logs long enough to investigate. State how your business receives logs during an incident or at termination.
- Test the promises. Schedule a backup restore, an alert-escalation exercise and an access review. Require written results and remediation dates.
Questions that expose gaps
- Which person or team reviews a high-severity endpoint alert, and what is the target response time?
- Can the provider isolate a device without waiting for an executive approval, and how is that action documented?
- How are provider administrator accounts separated from customer accounts, and what happens if a provider employee leaves?
- Where are protected backup copies stored, who can delete them, and when was the last successful restore test?
- How will you be notified if the provider suspects compromise of its remote-monitoring or management tools?
- Can you obtain configuration records, logs and backup credentials when the contract ends?
Choosing the operating model
Use internal operations when capability is demonstrable
Keeping management in-house can reduce third-party access and preserve direct control. It requires staff who can maintain endpoint policies, monitor alerts, patch systems, administer MFA, protect backups and lead response. Document on-call coverage so a holiday or staff absence does not create an unmonitored gap.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesUse managed IT for specific capacity gaps
Outsource tasks where your team lacks time or expertise, but retain oversight of privileged access, data ownership and recovery decisions. A provider can patch endpoints while your business owns backup accounts, or monitor EDR while an internal manager approves isolation and communications. The division must be explicit.
Use both with a responsibility matrix
A simple matrix should name one accountable owner for each control and a backup owner for absences.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
| Control | Accountable owner | Evidence to review |
|---|---|---|
| Endpoint enrollment and policy | Internal IT or contracted operator | Device inventory, policy status and exceptions |
| Alert triage and containment | Named monitoring team | Alert records, response times and isolation actions |
| MFA and privileged access | Identity administrator | MFA coverage, privileged-account and sign-in reviews |
| Patching | Systems administrator | Patch reports, failed updates and approved exceptions |
| Backup protection | Business owner with technical operator | Offline-copy checks, encryption status and restore-test results |
| Incident response | Business incident lead | Current contacts, tabletop records and post-incident actions |
Common failure modes and fixes
“We have antivirus, so we are covered.”
Antimalware is valuable, but it does not secure email accounts, patch a vulnerable VPN, restrict privileges or restore encrypted files. Fix the gap with MFA, a patch process, least privilege, protected backups and a tested response plan.
“Our MSP handles security.”
That statement has no useful meaning until the contract names the controls and response obligations. Obtain the written scope, review provider access and test a backup restore and alert escalation.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Alerts go to an inbox nobody watches
Route high-severity events to an assigned responder with an escalation path and after-hours coverage. Review sample alerts to confirm that notifications contain enough context to act.
Backups are online with the same administrator credentials
An attacker who controls the administrator can often encrypt or delete those copies. Separate backup identities, encrypt the data, keep a disconnected copy and test restoration.
Remote-management tools are trusted by default
Remote monitoring and management (RMM) tools are operationally useful but create concentrated privilege. Limit access, require MFA, log sessions, restrict tools to necessary systems and include provider-compromise procedures in the contract. CISA’s JCDC Remote Monitoring and Management Cyber Defense Plan addresses these security implications.
No one knows what to do during an outbreak
Write the first-hour actions and rehearse them. The plan should cover isolating affected devices, disabling compromised accounts, preserving evidence, protecting backups, notifying leadership and choosing the order of restoration.
A practical 30-day implementation sequence
- Days 1–5: Inventory devices, critical services, administrator accounts and existing backups. Identify internet-facing systems and unsupported software.
- Days 6–10: Enroll every supported endpoint in central antimalware management; enable EDR or application allowlisting where appropriate; route and test alerts.
- Days 11–15: Enable MFA for email, file storage, remote access and privileged accounts. Remove dormant users and separate administrator identities.
- Days 16–20: Patch priority systems, disable unnecessary services and document least-privilege changes and approved exceptions.
- Days 21–25: Create encrypted offline backup copies, restrict backup administration and perform a restoration test using a representative set of critical files.
- Days 26–30: Finalize the incident plan, responsibility matrix and provider contract language. Run a tabletop exercise and assign dates for unresolved fixes.
After the first month, repeat the checks on a schedule: endpoint coverage and alert review, privileged-account and MFA review, patch compliance, backup integrity and restoration, provider-access review, and incident-response exercises. Controls decay when ownership changes or systems are added without enrollment.
Bottom line
Endpoint security and managed IT solve different parts of the ransomware problem. Endpoint tools provide detection and containment on devices; managed IT can provide the people and processes to operate security controls, but its scope and access must be scrutinized. For most small businesses, deploy centrally managed endpoint protection and pair it with accountable IT operations, whether those operations are internal, outsourced or shared. Put MFA, patching, least privilege, offline encrypted backups, restore testing, provider-access limits and incident roles in writing, then verify each one with records and exercises.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
