Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If ransomware is suspected, follow your approved incident-response plan, isolate affected systems without destroying evidence, activate the right people, report through appropriate official channels, and restore only from clean, tested backups. A checklist is not a substitute for a plan. Adapt the steps below to your systems, legal obligations, insurance terms, leadership structure, and available IT support before an incident occurs.
What a small-business ransomware plan must cover
CISA’s #StopRansomware Guide provides the core sequence used here. CISA’s overview page says the guide was updated in May 2023; the guide version described for this checklist is dated September 2023. Its central instruction is direct: “Should your organization be a victim of ransomware, follow your approved IRP.” The guide was authored by CISA, the FBI, NSA, and MS-ISAC.
Your written plan should answer five operational questions before anyone is under pressure:
- Which systems and business services are critical, and what do they depend on?
- Who can isolate a device or network segment?
- Who informs leadership, employees, customers, insurers, lawyers, and regulators?
- Which external responders can help, and how are they reached if company systems are unavailable?
- How will the business restore operations without reintroducing the attacker?
Keep the plan securely available in more than one form, including an offline copy that remains usable if email, shared drives, identity systems, or file servers are compromised.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Preparation checklist: complete this before an attack
1. Inventory critical systems and dependencies
Make a current inventory of systems that support revenue, safety, legal obligations, payroll, customer service, production, and core administration. Include servers, workstations, network equipment, cloud services, SaaS applications, identity providers, remote-access tools, and major vendors.
For each service, record its owner, business purpose, dependencies, recovery priority, and a practical restoration contact. A customer-order system may depend on identity services, databases, DNS, payment processing, and a particular network segment. That dependency information determines the order of recovery when staff and equipment are limited.
Store diagrams, asset lists, administrator contacts, license details, recovery procedures, and system-image information where responders can reach them without relying solely on the potentially compromised environment.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →2. Write and exercise an incident-response and communications plan
Create a basic cyber incident-response plan (IRP) and a communications plan, then obtain leadership approval. Define what counts as a suspected ransomware incident, who can declare an incident, who has authority to disconnect systems, and who records decisions.
Assign named roles rather than relying on job titles alone:
- Incident lead: coordinates decisions, priorities, and status updates.
- Technical lead: identifies affected assets, isolates systems, preserves evidence, and coordinates restoration.
- Business lead: determines which services must be recovered first and approves continuity workarounds.
- Communications lead: manages employee, customer, supplier, and public messages.
- Legal, privacy, and insurance contacts: assess notification duties, privilege, policy requirements, and external assistance.
List primary and backup contacts, direct phone numbers, after-hours procedures, and out-of-band methods such as personal or alternate phone numbers. Exercise the plan periodically with a short scenario. Test whether people can find the plan, reach one another, identify who can make network changes, and perform a restoration decision without depending on the systems being tested.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
3. Build offline, encrypted backups and prove that they work
Maintain offline, encrypted backups of critical data. “Offline” means the backup copy is not continuously reachable from the production environment; a ransomware operator should not be able to encrypt or delete it through the same compromised credentials and network paths. Encryption protects the copy if the storage device is lost or stolen, but encryption alone does not make a backup resilient.
CISA specifically advises organizations to “regularly test the availability and integrity of backups in a disaster recovery scenario.” A successful backup job is not proof that restoration will succeed. Schedule restoration tests for representative files and complete systems, verify that recovered data opens correctly, and record how long each critical service takes to return.
An encrypted external hard drive can be one physical implementation of offline storage for a small organization, but it should not be treated as a complete backup architecture. Plan rotation, secure storage, access control, encryption-key recovery, capacity, retention, and protection from fire, theft, and accidental deletion. Maintain system images or other recovery materials where practical.
4. Decide who can act and what must be reported
Document who may disconnect a workstation, disable an account, change firewall or switch settings, contact a managed provider, notify leadership, engage an incident-response firm, and approve public communications. Identify the person who will assess whether personal or business customer information may have been affected.
Keep cyber-insurance, legal, forensic, managed-security, cloud-provider, and critical-vendor contacts accessible outside normal email and ticketing systems. Review policy requirements before an incident; some policies require prompt notice or the use of approved responders.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Active incident checklist: what to do first
1. Follow the approved plan and establish an incident lead
When ransomware is suspected—such as widespread file encryption, ransom notes, disabled security tools, or unusual account activity—declare the incident under your IRP. Record the time, initial symptoms, affected users, and actions taken. Avoid improvising a separate chain of command on every device.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
2. Identify and isolate affected systems promptly
Determine which computers, servers, accounts, network segments, and cloud resources show signs of compromise. Isolate affected systems from the network as soon as practical while coordinating the action with the technical lead.
If several systems or subnets appear affected, network-level isolation at a switch or other network-control point may be appropriate. If that is not feasible, disconnect affected devices from Ethernet and Wi-Fi. Isolation should prevent lateral movement and protect unaffected backups and services.
Do not reconnect a device merely to check whether it is safe. Treat a system as untrusted until responders have assessed it and it is ready for a controlled rebuild or restoration.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →3. Coordinate isolation using out-of-band communications
Use phone calls or another communications method that is not dependent on potentially compromised email, chat, file shares, or identity systems. CISA warns that attackers may monitor organizational activity and that uncoordinated actions can give them warning. Tell the response team which systems are being isolated, by whom, at what time, and what evidence must be preserved.
4. Do not power down automatically
Turning off an infected computer can remove volatile-memory evidence, including information that may help determine how the intrusion occurred or whether the attacker remains present. CISA treats powering down as a fallback when temporary network disconnection or host disconnection is not possible—not as the automatic first step.
First disconnect the host from the network when you can do so safely and preserve relevant evidence and logs. If network or host disconnection cannot contain the threat, follow the IRP’s emergency shutdown procedure and record who authorized it and why.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
5. Triage scope, evidence, and business priorities
Use available endpoint, identity, firewall, cloud, and backup logs to look for additional impacted systems. Preserve relevant logs, ransom notes, suspicious emails, filenames, timestamps, and memory or disk images where feasible and lawful. Do not delete evidence simply to make screens or file shares look normal.
At the same time, identify the critical services that must be restored first. Separate confirmed impact from assumptions, and maintain a written timeline of decisions, affected assets, downtime, and outstanding questions.
Coordinate responders and report the incident
Activate internal and external help
Activate the response and communications plans. Keep leadership informed through an agreed cadence, even when there is no major change. Involve relevant IT or managed-service staff, managed security providers, cyber-insurance representatives, legal counsel, privacy advisers, communications staff, and business-continuity owners according to the circumstances.
External responders can help with containment, forensic preservation, eradication, negotiation decisions, recovery engineering, and notification analysis. Evaluate any provider for response scope, availability, geography, credentials, and fit with your systems before an emergency. Do not wait until every technical detail is known before calling for help.
Consider official reporting
CISA’s response checklist says organizations should consider reporting to CISA, the local FBI field office, or the FBI Internet Crime Complaint Center and seek appropriate assistance. Preserve the incident timeline and technical details that responders can share safely. Reporting can support broader threat awareness and may help connect a business with investigative or technical resources.
Assess data exposure and notification duties
Ransomware may involve both encryption and unauthorized access or theft. Determine whether personal information, regulated records, credentials, intellectual property, or customer data may have been exposed. Follow the organization’s notification plan and obtain legal advice about applicable requirements.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
There is no single deadline that applies to every business. Duties depend on jurisdiction, sector, the type of data, contractual commitments, and what the investigation establishes. Do not promise that no data was accessed until an appropriate assessment supports that conclusion.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Recover without reinfecting the business
1. Restore in a documented priority order
Use the inventory and dependency map to restore critical services first. Establish a clean recovery environment separate from compromised systems and accounts. Restore operating systems, applications, configurations, and data from known-clean sources, then apply security updates and required configuration changes before reconnecting production users.
Keep compromised systems off the clean recovery network until responders have determined how they will be rebuilt, reimaged, or safely retired. Reset exposed credentials, especially privileged, service, remote-access, and cloud identities, using a controlled sequence that does not lock responders out of the environment.
2. Validate each service before returning it to use
- Confirm that restored files and databases are complete and usable.
- Check that authentication, permissions, integrations, and backups work as intended.
- Scan restored systems and review logs for evidence of persistence or renewed access.
- Bring services back in stages, watching for abnormal encryption, account activity, or network connections.
- Record the recovery time and any manual workaround still required by staff.
3. Document lessons and update the plan
After stabilization, document impact, decisions, costs, control failures, evidence preserved, restoration results, and unresolved risks. Hold a no-blame review with technical and business participants. Update the IRP, contact lists, asset inventory, backup design, access controls, monitoring, employee guidance, and exercise scenarios. Schedule a follow-up test so improvements are verified rather than merely noted.
Choosing a recovery approach
Assess every backup or recovery design against the same practical questions: Can ransomware reach it from the production environment? Is data encrypted at rest and in transit? Has restoration and integrity been tested? How quickly can critical services return? Are administrator accounts and cloud environments separated? Does the design fit the business’s systems, continuity needs, compliance obligations, and staff capacity?
| Approach | What to verify | Important trade-offs |
|---|---|---|
| Offline encrypted storage | Physical or logical isolation, encryption-key recovery, rotation, secure storage, tested restoration, and enough capacity for critical data | Requires disciplined handling and may restore more slowly; one device alone does not provide complete resilience |
| Cloud storage with immutability or protected recovery points | Immutability settings, separate administration, recovery-account protection, retention, restoration speed, and configuration monitoring | CISA notes trade-offs involving compliance, misconfiguration cost, and dependence on a provider |
| Multiple cloud environments | Independent credentials, network and account separation, documented dependencies, cross-environment recovery tests, and clear ownership | Can improve separation but increases operational complexity, compliance work, and possible vendor lock-in |
Choose a design that your staff can operate and test consistently. A theoretically strong architecture that nobody can restore from is weaker than a simpler design with verified procedures, protected credentials, and regular exercises.
Quick Recap
Printable incident sequence
- Declare a suspected ransomware incident under the approved IRP and appoint the incident lead.
- Use out-of-band communications to coordinate the response.
- Identify affected hosts, accounts, services, and network segments.
- Isolate affected systems; use network-level isolation when several systems or subnets are involved.
- Do not power down unless network or host disconnection is not possible; preserve volatile evidence where feasible.
- Activate technical, leadership, legal, insurance, communications, and continuity contacts as appropriate.
- Review logs and security tools, preserve evidence, and determine whether data may have been accessed.
- Consider reporting to CISA, the local FBI field office, or the FBI Internet Crime Complaint Center.
- Restore prioritized services in a clean environment from offline, encrypted, tested backups.
- Validate restored services, document the incident, and update the plan and exercises.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
