The SME ransomware playbook: before, during, after

Ransomware can disrupt organisations of any size. Preparation should cover both loss of access to systems and possible data theft; backups address only part of that risk.

Before: strengthen the essentials

• Use multifactor authentication, preferably phishing-resistant, and limit privileged access.
• Keep offline or immutable backups and test restoration.
• Prioritise patching of exposed systems and known exploited vulnerabilities.
• Document incident contacts, responsibilities and an alternative communication channel.

During: isolate and coordinate

Isolate affected systems from the network and activate the incident-response plan. Coordinate with qualified responders, preserve logs and evidence, and use an unaffected communication channel. Avoid wiping systems or making unplanned recovery changes. If isolation is impossible, responders may recommend powering down to limit spread, recognising the loss of volatile evidence.

After: restore with care

Confirm containment, investigate access paths, and validate backups before restoring into a clean environment. Reset affected credentials in a coordinated way, monitor for recurrence, and assess possible data exposure. Recovery priorities and any notification obligations need case-specific professional advice.

A tested backup is one part of recovery, alongside containment, evidence preservation and a coordinated response.

Review what happened and update the response plan. Do not assume restoration alone removes the attacker or resolves every consequence of the incident.