Ransomware locks your files and then demands payment to unlock them. Many attackers also copy your data first and threaten to publish it. Small businesses are hit often because they are easier to get into and less likely to have a tested backup.
You cannot make an attack impossible. You can make it survivable: backups the attacker cannot reach, fewer ways in, and a plan everyone can follow in the first hour, when panic makes the worst decisions.
Part 1: Backups that survive an attack
- Follow 3-2-1: three copies of your important data, on two different types of storage, with one copy off-site.
- Keep one copy offline or immutable. Ransomware looks for connected drives and backup accounts and encrypts or deletes them too. An offline copy (a drive that is unplugged and stored away) or an immutable cloud backup (one that cannot be changed or deleted for a set period) is the copy that saves you.
- Back up the cloud too. Microsoft 365 and Google Workspace data needs its own backup. Synced folders like OneDrive or Dropbox copy damage as faithfully as they copy files.
- Protect the backup account. Use separate credentials with MFA, not your everyday admin account.
- Test a restore every three months. Pick a real folder and a real mailbox and restore them. Time it. Write down how long a full restore would take, and decide whether the business can wait that long.
- Know what you would restore first: accounting, client files, email, the line-of-business app. Write the order down.
Part 2: Fewer ways in
- Patch fast. Turn on automatic updates for Windows, macOS, browsers and phones. Patch internet-facing systems (firewall, VPN, remote access, website) as soon as a critical update is released, because attackers scan for these within days.
- Replace anything past end of support. A computer or firewall that no longer gets security updates is an open door.
- MFA on everything remote: email, VPN, remote desktop tools, backup consoles, banking and accounting.
- Never expose Remote Desktop (RDP) directly to the internet. Put it behind a VPN or a secure remote-access service with MFA.
- Least privilege: staff use standard accounts, not local administrator accounts. Admins use a separate account for admin work. Remove access for people who leave on their last day.
- Endpoint protection on every computer, with someone actually watching its alerts.
- Train for phishing. Most ransomware still starts with a stolen password or a malicious attachment.
Part 3: The first-hour checklist
Print this. Keep a paper copy somewhere other than the office computers, because those may not work.
- Minute 0: Isolate. Unplug affected computers from the network and turn off their Wi-Fi. Do not power them off unless your IT provider says so, because evidence in memory can help the investigation.
- Minute 5: Call your cyber insurer's breach hotline, if you have one. Many policies require you to call them first and use their approved responders, or they may not pay.
- Minute 10: Call your IT provider or incident responder. Tell them what you see, which machines, and when it started.
- Minute 15: Switch to safe communication. Assume email and chat may be watched. Use personal phones and a group text for the response team.
- Minute 20: Protect the backups. Disconnect backup drives and confirm the backup account has not been changed. Do not start restoring yet.
- Minute 30: Preserve evidence. Photograph the ransom note. Do not delete files, wipe machines or reinstall anything until the responder says so.
- Minute 40: Do not contact or pay the attackers before you have spoken with your insurer, your responder and the police.
- Minute 45: Change critical passwords from a clean device, starting with admin, email, banking and backup accounts.
- Minute 50: Start a timeline. Who noticed what, when, and every action taken. Insurers, police and the privacy regulator will ask.
- Minute 60: Decide who tells staff, clients and suppliers what, and when. Say only what you know.
Who to call
Fill in these numbers now, not during an attack.
- Your IT provider or incident responder: [name, 24/7 number]
- Your cyber insurer's breach hotline and policy number: [number]
- Your bank's fraud line, in case payments or accounts were touched: [number]
- Canadian Centre for Cyber Security: report the incident online at cyber.gc.ca (Report a cyber incident) or call 1-833-CYBER-88 (1-833-292-3788). They can share advice and warnings, and reports help protect other businesses.
- Police, non-emergency line: your local police service. In Ottawa, the Ottawa Police non-emergency line is 613-236-1222. Call 911 only if someone is in danger.
- Canadian Anti-Fraud Centre: 1-888-495-8501, if money was lost or fraud was involved.
- Your lawyer or breach coach, for notification decisions.
Privacy reporting in Canada
If personal information was accessed or stolen, you may have legal duties. Under PIPEDA, private-sector organizations must report a breach that creates a real risk of significant harm to the Office of the Privacy Commissioner of Canada, notify the affected people, and keep a record of every breach for 24 months. Quebec's Law 25 requires reporting confidentiality incidents that present a risk of serious injury to the Commission d'accès à l'information. Some provinces and sectors (health, for example) have their own rules. Get advice early.
This plan is a starting point, not legal advice. If you hold health, financial or large volumes of personal data, have a lawyer and a security professional review it.
Questions to ask your cyber insurer
- Does the policy cover ransomware, including business interruption while we are down? Is there a waiting period before that coverage starts?
- Is there a separate, lower limit (a sublimit) for ransomware or extortion?
- Who must we call first, and must we use your panel of responders and lawyers?
- What security controls does the policy require (MFA, backups, endpoint protection, patching)? Could a claim be denied if one was missing on the day?
- Does it cover restoring data, rebuilding systems and replacing hardware?
- Does it cover social-engineering fraud, such as a fake invoice we paid?
- Does it cover privacy breach costs: notifying people, credit monitoring, legal fees and regulatory investigations?
- Does it cover claims from clients whose data was exposed?
- What is the deductible, and does it apply per incident?
Write your plan with AI
Fill in the brackets and paste the prompt into ChatGPT, Claude or Gemini. It writes a one-page incident plan and a backup checklist for your business that you can print.
Write a ransomware readiness plan for my small business. It must fit on two printed pages and be usable by non-technical staff under stress. Business: [name], [industry], [city, province], [number of staff] Systems: [e.g. Microsoft 365 / Google Workspace, accounting software, line-of-business app, file server or cloud storage] Devices: [e.g. 10 Windows laptops, 2 Macs, 1 server, phones] Backups today: [what is backed up, where, how often, offline or immutable copy yes/no, last tested restore date] Remote access: [VPN, remote desktop, none] Admin rights: [do staff have local admin? separate admin accounts?] Cyber insurance: [yes/no] Personal information we hold: [e.g. client names and addresses, health info, payment info] Response team: [roles, e.g. owner, office manager, IT provider] Write: 1. A backup checklist using 3-2-1, with what I am missing and the order to restore systems in. 2. A "fewer ways in" checklist: patching, end-of-support devices, MFA, remote access, least privilege. Mark each item done / missing based on what I told you. 3. A first-hour checklist with times (minute 0 to 60): isolate, call insurer, call IT, safe communication, protect backups, preserve evidence, do not pay or contact attackers yet, change passwords from a clean device, keep a timeline, plan communications. 4. A "who to call" table with blank spaces for my numbers, including the Canadian Centre for Cyber Security (cyber.gc.ca, 1-833-CYBER-88), my local police non-emergency line, the Canadian Anti-Fraud Centre, my insurer and my bank. 5. A short note on Canadian privacy breach reporting (PIPEDA, and Quebec Law 25 if I work with Quebec clients) and when to call a lawyer. 6. Ten questions to ask my insurer about ransomware cover. Rules: plain language, short lines, no jargon without a one-line explanation. Do not recommend specific paid products unless I ask. Do not give legal advice beyond pointing to the rules. Canadian English.
Do not paste passwords, policy numbers or customer data into an AI tool. Add those to the printed copy by hand.
Want help getting ready?
We set up tested backups, patching, endpoint protection and MFA for small businesses, and can review your plan before you need it. The Canadian Centre for Cyber Security's baseline controls for small and medium organizations are also a good free reference.