Ransomware Protection for a Small Business: The Practical Guide
Ransomware encrypts your files and demands payment — and for a small business it is rarely the ransom itself that kills. It is the week of downtime, the lost bookings and invoices, and the customers who quietly go elsewhere. Industry reports find ransomware present in the large majority of breaches affecting smaller companies, which is exactly why preparation, not payment, is the strategy.
How ransomware gets in
The entry points are unglamorous: a phished password without MFA, an unpatched internet-facing system, an exposed remote-desktop connection, or a malicious email attachment. Everything in this guide is about closing those doors and making sure that if one opens, the damage stays small.
The three pillars of protection
1. Backups that ransomware cannot touch
Follow 3-2-1: three copies of your data, two different storage types, one copy off-site or offline. At least one copy must be immutable or physically disconnected — backups the network can reach, ransomware can encrypt. Test restores quarterly: pick real files and a real system, restore them, and time it. Owner rule: an untested backup is not a backup.
2. Segmentation and least privilege
If the reception PC and the server share one flat network with one all-powerful account, one infection becomes total. Separate guest Wi-Fi from business systems, give staff only the access their job needs, and keep admin accounts distinct from daily accounts. Segmentation is what turns "a computer got encrypted" into a containable incident instead of a shutdown.
3. Prevention basics, done relentlessly
MFA on everything, automatic patching, behaviour-based endpoint protection, and phishing defences. These are the same foundations as the small business cybersecurity checklist — ransomware is the reason they cannot slip.
Your first-hour incident plan
- Isolate: disconnect affected machines from the network (unplug / disable Wi-Fi) — do not switch them off unless told to; evidence matters.
- Protect accounts: change passwords for email and admin accounts from a clean device; revoke sessions.
- Call for help: your IT provider or incident responder, your bank if payment data is involved, and your insurer if you have a policy.
- Communicate: one named person updates staff and customers with honest, brief facts.
- Recover: rebuild from known-clean backups onto checked systems — never straight back onto the infected network.
Should you ever pay the ransom?
Law enforcement and insurers generally advise against it: payment does not guarantee a working key, marks you as a payer, and may create legal exposure. Businesses that recover fastest are the ones with clean backups and a rehearsed plan — which is why the pillars above are the whole game. For the cost side, see what cybersecurity costs for a small business — a backup service costs a fraction of one day of downtime.
Frequently asked questions
Does cyber insurance pay ransoms?
Policies vary and increasingly focus on recovery costs and liability rather than ransom payment. Insurers also require basics like MFA and backups before they will cover you at all.
How often should backups run?
At least daily for business data; hourly for systems you cannot afford to lose a day from. The right interval is "how much work can we re-do?" — answer honestly.
Keep reading: the small business cybersecurity checklist · how to prevent phishing attacks · ransomware protection for small business