Ransomware has a special talent for making everyone suddenly interested in backups. Before an attack, backups sound like something the IT person keeps mentioning during budget season. After an attack, backups become the most important thing in the building, right after coffee and panic breathing.
The cruel part is that backups only help if they were designed before the emergency. A folder synced to the cloud is not always a backup. A backup that ransomware can encrypt is not much of a backup. A backup nobody has tested is basically a motivational poster.
For small businesses, the goal is not to build a Fortune 500 disaster recovery program overnight. The goal is to create a practical, affordable backup system that can survive ransomware and get the company operating again.
This guide explains how cloud backup works, what ransomware changes, and how small businesses can set up a recovery plan that is boring in the best possible way.
Why Ransomware Changes the Backup Conversation
Traditional data loss is usually accidental. Someone deletes a file. A laptop dies. A hard drive gives up on life. In those cases, almost any recent copy can help.
Ransomware is different because the attacker may try to destroy or encrypt your backups too. Modern ransomware groups understand that backups are the escape hatch. If they can close the hatch, they have more leverage.
That means your backup strategy needs to answer three questions:
- Can we restore clean data?
- Can ransomware reach the backups?
- Have we tested restoration before the crisis?
If the answer to any of those is “not sure,” that is not a strategy. That is hope wearing a lanyard.
Cloud Sync Is Not the Same as Cloud Backup
This is one of the most common mistakes.
Cloud sync tools such as shared drives are useful for collaboration. They keep files updated across devices. But if ransomware encrypts local files, the encrypted versions may sync to the cloud. Some services offer version history, which can help, but sync alone is not a complete ransomware recovery plan.
A true backup should provide:
- Version history
- Point-in-time recovery
- Protection from deletion or tampering
- Separate access controls
- Retention policies
- Restore testing
Cloud sync says, “Here is the current version.”
Cloud backup says, “Here are previous versions from before everything went sideways.”
That difference matters.
The 3-2-1 Backup Rule Still Matters
A classic backup principle is the 3-2-1 rule:
- Keep 3 copies of important data
- Store them on 2 different types of media or systems
- Keep 1 copy offsite
For ransomware, many experts now add another idea: one copy should be offline, immutable, or otherwise protected from modification.
A modern small-business version might look like this:
- Primary data on laptops, servers, or cloud apps
- Cloud backup with versioning and retention
- Offline or immutable backup copy stored separately
You do not need museum-level complexity. You need separation. If one compromised admin account can delete every backup, the system is too fragile.
What “Immutable Backup” Means
Immutable backup means that once data is written, it cannot be changed or deleted for a defined period. This can prevent attackers from destroying backups even if they gain access.
Common forms include:
- Object lock storage
- Write once, read many policies
- Backup vendor immutability features
- Offline drives rotated and disconnected
- Separate cloud accounts with restricted access
For small businesses, immutability may sound technical, but the concept is simple: the backup should be harder to tamper with than normal files.
Ask any backup provider directly:
- Can backups be made immutable?
- Who can delete backup snapshots?
- Is deletion protected by MFA?
- Are admin actions logged?
- How long are versions retained?
If the sales page only says “military-grade” and avoids specifics, keep asking.
Decide What Actually Needs Backing Up
Not all data has the same value. Start with business-critical systems.
Common priorities:
- Accounting files
- Customer records
- Contracts
- Project files
- Email archives
- Website files and database
- Inventory or order systems
- HR and payroll documents
- Password manager recovery data
- Configuration files for key software
Then classify data by recovery urgency.
Tier 1: Must Restore Quickly
These systems stop revenue or operations if unavailable. Examples: accounting, point-of-sale, customer database, production files.
Tier 2: Important but Can Wait
These matter, but the business can operate briefly without them. Examples: older project archives, marketing assets, internal documents.
Tier 3: Nice To Have
These are useful but not essential. Do not spend premium backup money on digital clutter.
This classification helps control cost and restoration time.
Define Recovery Time and Recovery Point Goals
Two terms sound boring but are very useful:
Recovery Time Objective (RTO)
How quickly do you need to be running again?
If your accounting system is down, can you survive one day? Three days? One week?
Recovery Point Objective (RPO)
How much data can you afford to lose?
If you restore from last night, is that acceptable? What about last week?
Example:
- Customer orders: RTO 4 hours, RPO 1 hour
- Accounting: RTO 24 hours, RPO 24 hours
- Marketing archive: RTO 7 days, RPO 1 week
These targets guide backup frequency and cost. Not everything needs minute-by-minute backup.
Secure the Backup Admin Account
Your backup system is only as safe as the account controlling it.
Minimum controls:
- Use a dedicated admin account
- Enable multi-factor authentication
- Do not reuse passwords
- Limit who can delete backups
- Separate backup admin from everyday email
- Review access quarterly
- Store recovery codes securely
If possible, use role-based access. The person who can restore files does not always need the ability to delete all backup history.
Back Up Cloud Apps Too
Many small businesses assume that if data lives in a cloud app, the provider automatically handles everything. Providers usually protect the platform, but you may still be responsible for accidental deletion, account compromise, retention settings, or ransomware-like data corruption.
Consider backup for:
- Microsoft 365
- Google Workspace
- QuickBooks or accounting exports
- CRM systems
- Website CMS and database
- Project management tools
Check each provider’s retention and recovery features. Some built-in tools are enough for basic needs. Others may require a third-party backup service.
Test Restores Like a Fire Drill
A backup is not real until you restore from it.
Schedule a quarterly restore test:
- Pick a sample file or system
- Restore it to a safe location
- Confirm it opens correctly
- Record how long it took
- Note any missing permissions or dependencies
- Update the process
Once a year, test a larger recovery scenario. Pretend one laptop or one shared folder is gone. Can you rebuild it?
Testing often reveals boring problems:
- Nobody knows the admin password
- The backup skipped a key folder
- Version retention was too short
- Restores are slower than expected
- File permissions are broken
Boring problems discovered early are gifts. Boring problems discovered during ransomware are invoices from hell.
Keep an Offline Copy
Cloud backup is convenient, but an offline copy provides extra resilience.
Options:
- External drives rotated weekly
- Network storage disconnected after backup
- Encrypted drive stored offsite
- Periodic export of critical cloud data
Rules:
- Encrypt the drive
- Disconnect it after backup
- Store it securely
- Label dates clearly
- Test restoration
An offline backup does not need to contain every file. It should contain the data required to keep the business alive.
Create a Ransomware Recovery Runbook
When ransomware hits, nobody wants to improvise. Write a simple runbook.
Include:
- Who to call internally
- Bank and cyber insurance contacts
- IT provider contact
- Legal or incident response contact if available
- Backup provider login process
- Priority systems to restore first
- How to isolate infected devices
- How to communicate with employees
- How to document the incident
Print a copy. Store one offline. If your runbook only exists on an encrypted laptop, it has joined the enemy.
Should You Pay the Ransom?
This is a legal, operational, and ethical question. In many cases, law enforcement agencies discourage paying because payment does not guarantee recovery and may fund criminal activity. There may also be sanctions or legal restrictions depending on the recipient.
From a backup strategy perspective, the goal is simple: create enough recovery capability that payment is not your only option.
Talk to legal counsel, law enforcement, your insurer, and incident response professionals if an attack occurs.
Small Business Backup Checklist
Use this as a starting point:
- Identify critical data and systems
- Classify recovery priorities
- Set RTO and RPO targets
- Use cloud backup with versioning
- Add immutable or offline backup protection
- Enable MFA for backup admin accounts
- Back up cloud apps where needed
- Test restores quarterly
- Document the recovery process
- Review backup reports monthly
- Keep emergency contacts offline
Final Thoughts
Ransomware recovery is not about having the fanciest backup product. It is about having clean, protected, tested copies of the data your business needs to survive.
The best backup plan is boring before the crisis and beautiful during it.
If your current strategy is “we have a shared drive somewhere,” fix that before an attacker turns your file system into modern art.
Sources
- CISA ransomware guidance: https://www.cisa.gov/stopransomware
- NIST Small Business Cybersecurity Corner: https://www.nist.gov/itl/smallbusinesscyber
- FTC cybersecurity for small business: https://www.ftc.gov/business-guidance/small-businesses/cybersecurity
- Microsoft guidance on ransomware protection: https://www.microsoft.com/en-us/security/business/security-101/what-is-ransomware