Ransomware Protection Checklist for Small and Mid-Sized Businesses
Twelve practical steps, in priority order, that make a ransomware attack far less likely and far less damaging, even with a small IT team.
Ransomware is no longer a problem only for large corporations. Attackers increasingly target small and mid-sized businesses, because they often have valuable data, limited security staff and a strong need to get back to work quickly. The good news: a short list of basic controls blocks most attacks and limits the damage when something gets through.
This checklist is ordered by impact. If you only do the first five, you are already much safer.
1. Backups that ransomware cannot reach
Backups are your last line of defence. They only help if attackers cannot encrypt or delete them.
- Follow the 3-2-1 rule: three copies of data, on two different types of storage, with one copy offline or immutable.
- Use immutable or versioned cloud storage, or a backup system with separate credentials.
- Test restores regularly. A backup that has never been restored is a hope, not a plan.
2. Multi-factor authentication everywhere it matters
Stolen passwords are one of the most common ways in. Turn on MFA for:
- Email and Microsoft 365 or Google Workspace.
- VPN and remote access tools.
- Admin accounts, cloud consoles and backup systems.
Prefer authenticator apps or security keys over SMS codes where possible.
3. Close remote access doors
Exposed Remote Desktop (RDP) and outdated VPN appliances are favourite entry points.
- Never expose RDP directly to the internet.
- Put remote access behind a VPN or zero-trust gateway with MFA.
- Remove remote access accounts that are no longer needed.
4. Patch quickly, starting with internet-facing systems
Prioritise updates for firewalls, VPNs, email servers, web servers and remote access tools. Government agencies such as CISA publish a catalogue of vulnerabilities known to be exploited in real attacks; treat anything on that list as urgent.
5. Least privilege for users and admins
- Daily work should happen in standard user accounts, not admin accounts.
- Use separate admin accounts only for admin tasks.
- Review who has access to shared drives and finance systems every quarter.
6. Email and web filtering
Phishing emails still deliver a large share of ransomware. Use your email provider's protection features, block risky attachment types such as macros from the internet, and filter malicious websites at the DNS or firewall level.
7. Endpoint protection with detection
Modern endpoint detection and response (EDR) tools spot suspicious behaviour, such as mass file encryption, and can isolate a device automatically. Make sure it is installed on every laptop, desktop and server, and that someone actually reviews the alerts.
8. Asset inventory
You cannot protect what you do not know about. Keep a list of devices, servers, cloud services and who owns them. Old, forgotten servers are frequent victims.
9. Network segmentation
Separate critical systems such as finance, backups and production servers from the general office network. If one PC is infected, segmentation stops the attack from spreading everywhere.
10. Security awareness, short and regular
Five-minute monthly reminders work better than one long annual training. Teach staff to report suspicious emails quickly, and thank them when they do.
11. An incident response plan on paper
Decide in advance:
- Who is in charge during an incident, and how to reach them outside office hours.
- How to isolate infected machines.
- Which external partners to call: IT provider, insurer, legal advisor.
- How to communicate with staff and customers.
Print it. During an attack you may not be able to open shared files.
12. Practice
Run a short tabletop exercise once or twice a year: "It's Monday morning and file servers are encrypted. What do we do?" You will find gaps in the plan before attackers do.
Quick self-assessment
| Control | In place? |
|---|---|
| Offline or immutable backups, tested in the last 3 months | ☐ |
| MFA on email, VPN and admin accounts | ☐ |
| No RDP exposed to the internet | ☐ |
| Internet-facing systems patched within days | ☐ |
| Staff work without admin rights | ☐ |
| EDR on all devices, alerts reviewed | ☐ |
| Written incident response plan | ☐ |
Frequently asked questions
Should we pay the ransom? Authorities generally advise against paying, because payment does not guarantee recovery, may fund further crime and can have legal implications. Good backups are what give you a real choice. Involve legal advisors and, where applicable, report the incident to the relevant authorities.
Is cloud storage like OneDrive or Google Drive a backup? Not by itself. Synced folders can sync encrypted files too. Use version history and retention features, and keep a separate backup that ransomware cannot reach.
How often should we test restores? At least quarterly for important systems, and after any major change to your backup setup. Test restoring a full server, not only individual files.
What is the first thing to do if we see encrypted files? Disconnect affected machines from the network, do not switch them off if your responders may need memory evidence, and call your IT provider or incident response contact immediately.
Key takeaways
- Immutable, tested backups and MFA give the biggest protection for the least effort.
- Close exposed remote access and patch internet-facing systems first.
- Limit admin rights and segment critical systems to contain an attack.
- Prepare and practise your response before you need it.
KHR Digital Solutions helps businesses harden their servers, backups and access controls as part of our infrastructure and support services. Security is not a product you buy once; it is a set of habits.
Related articles
Password Managers for Teams: Why Your Business Needs One and How to Roll It Out
Shared passwords in spreadsheets and chats are a security risk. How team password managers work, what to look for and a smooth rollout plan.
Microsoft 365 and Google Workspace Security: 10 Settings Every Business Should Check
Most business email accounts are protected by default settings that leave gaps. Ten configuration checks that close the most common attack paths.
Phishing in 2026: How to Recognise and Stop Modern Attacks
Phishing has moved beyond badly written emails to AI-written messages, QR codes, fake login pages and voice calls. Warning signs and defences that work.