Direct answer
Quick answer
Small businesses reduce ransomware risk by combining tested offline or isolated backups, prompt security updates, multi-factor authentication, restricted administrator access, endpoint protection and staff awareness. A written recovery plan is also essential: backups only help when the organisation can restore them safely and knows how to respond to an incident.
Key takeaways
How ransomware spreads
Email attachments, exposed devices, and weak credentials are common attack paths.
Controls that reduce risk
Backups, MFA, patching, and endpoint security are the core defences.
Recovery planning
Plan ahead for restoration, communication, and service continuity.
Reduce the routes into the organisation
Prioritise supported software, prompt security updates, multi-factor authentication, restricted administrator privileges and secure remote access. Disable exposed services that are not required and review supplier access. Email filtering helps, but staff also need a simple way to verify unusual payment or credential requests. Asset records make it possible to identify unsupported devices and confirm whether important systems were included in patching and protection routines.
Design backups for recovery, not reassurance
A successful backup notification does not prove that the organisation can restore operations. Keep protected or offline copies that an attacker using normal administrator credentials cannot alter, define retention around business needs and test representative restores. Record the order in which identity, communications, files and applications must return. Recovery objectives should reflect how much data and downtime the organisation can genuinely tolerate.
Prepare an incident response checklist
Decide who can isolate devices, contact suppliers, communicate with staff and customers, assess legal obligations and authorise recovery work. If an attack occurs, disconnect affected systems carefully, preserve useful logs and avoid destroying evidence through rushed rebuilding. The National Cyber Security Centre and relevant insurers or professional advisers may need to be involved. Practise the plan with a short tabletop exercise so missing contacts and assumptions are found before a real incident.
FAQ
What is the best ransomware defence?
Layered protection, backups, MFA, patching, and user training together are most effective.
Should I pay a ransom?
That depends on the situation, but good backup and recovery planning reduces the chance of ever needing to consider it.
Official sources and further reading