Practical Ransomware Response Guide for SMBs

If you are under attack, skip this article and contact our rapid response cybersecurity experts here – Speak To An Expert.

One of the biggest misconceptions online is that attackers don't target small businesses. But that isn't true.

In fact, small businesses are often attractive targets because they usually have fewer cybersecurity resources and less mature security controls than larger organisations. That makes them easier opportunities for attackers looking for vulnerable systems. Ransomware is among the most common attacks facing small and medium-sized businesses.

Ransomware can take a normal business day and turn it upside down in the blink of an eye. Sensitive files will become inaccessible, systems stop working, and employees cannot access what they need. 

And boom, a ransom note appears on the screen telling you what to do next if you want to gain access to your assets again.

The ransom note is not your incident response plan. You need to swing into action and follow your already structured incident response plan. 

For a small or medium-sized business, what you do in the first few hours matters. You need to contain the attack, understand what has been affected, preserve useful evidence, and work out how you are going to recover. 

Trying to decrypt files immediately or wiping machines without understanding what happened can make the situation worse. In this article, we will discuss a practical guide SMBs can follow to respond to any ransomware attack or incident.

Before we dive into the details of this content, organisations seeking formal standardised adoption to ransomware response can also refer to NIST SP 800-61r3 which details the various stages relevant when responding to cybersecurity and information systems incidents. The article builds on that by providing clear and direct advice for organisations to apply immediately.

Confirm the Attack and Start the Response

There’s no place for assumptions in cybersecurity. So, don't assume the ransom note tells you everything. It only tells you what the attacker wants you to know. Without further analysis and investigation, you won’t know when they got in, how they gained access, which accounts they used, or whether they took data before encrypting it.

The first step is to confirm what is actually happening. Check the obvious signs, which could include encrypted files, ransom notes, unusual system behaviour, disabled security tools, or several computers showing similar symptoms. Once you confirm it’s ransomware, start treating it as an incident rather than just another malware infection.

NIST's current ransomware guidance approaches ransomware as a full incident response and recovery problem, covering areas such as identifying, protecting, detecting, responding to, and recovering from an attack.

Isolate Affected Systems

Now that you have confirmed it’s a ransomware attack, your next important step is containment. You need to contain the incident so it won’t spread to other systems on the network. First, ensure you disconnect affected computers from the network.

If several systems are affected and they are only part of a segment, you may need to isolate the network segment rather than trying to handle every machine separately.

CISA recommends isolating affected systems quickly to limit the spread of ransomware. However, you shouldn’t make hasty decisions here. You need to think before acting.

Don't automatically shut down or wipe every machine you find, as they may contain useful evidence that can help you understand what happened. Turning them off or making major changes can affect that evidence.

The right approach depends on the incident. Your priority should be stopping further spread while preserving information that may be useful for the investigation.

If your normal email or messaging platforms may also be compromised, use an alternative communication method like dedicated SIMS or a new secure email service to coordinate the response.

Preserve the Evidence

As mentioned earlier, trying to wipe or shut down every machine can actually make things harder. You need to preserve evidence so you can understand how the attack happened.

You can do this by keeping the ransom notes, saving suspicious emails and files and recording which systems were affected. Take note of all relevant logs, timestamps, usernames, and other indicators that could help establish what happened.

If you have the technical capability or an incident-response provider available, consider preserving system or memory images before making major changes.

You may eventually need this information to determine how the attacker got in, and what they accessed.

So don't start deleting files, clearing logs, or reinstalling machines simply because you want the environment to look clean again.

Determine How Far the Attack Went

Ransomware can move quickly to other systems if not contained fast. So you shouldn’t stop when you find ransomware on one computer. Continue to check your endpoints, servers, virtual machines, file shares, NAS devices, VPN access, remote-access systems, cloud services, email accounts, and backup infrastructure. Pay particular attention to administrators and other privileged accounts.

You also need to consider whether data was stolen before the encryption happened. Ransomware attacks can involve both data encryption and data theft, with attackers using the stolen information as additional leverage. NIST's current ransomware profile recognises this type of behaviour.

At this point, you may not have a complete picture. That's okay. Start building one. Separate the systems you know are affected from those that appear unaffected, and keep investigating anything you cannot confidently classify.

Bring in the Right People

Not every SMB has an incident-response team or digital-forensics specialist. That doesn't mean you should try to handle a serious ransomware incident by yourself.

Get your IT or security team involved. If you use an MSP, MSSP, or other security provider such as BridgeLynk.io, bring them in early. For a significant incident, an incident-response or digital-forensics specialist may also be necessary.

You may also need your cyber-insurance provider, legal team, senior management, regulators, or law enforcement.

The important thing is to have people working on the same picture. You don't want one person restoring systems while another is still trying to determine whether the attacker has access.

Recover from Clean Backups

Having a proper backup strategy can never be stressed enough. It’s highly important, and it can make a huge difference when ransomware hits.

But don't assume that every backup you have is safe. Ransomware can affect backups that are connected to the same environment, and attackers may deliberately look for backup systems. CISA recommends maintaining offline, encrypted backups and testing them regularly.

Before restoring anything, you need to investigate where the attack started. You don't want to restore a backup that already contains the attacker's access or compromised files.

You also need to make sure the environment you are restoring into is safe. If the original vulnerability or compromised credentials have not been addressed, restoring the systems may only give the attacker another opportunity to get back in.

Recovery is also about more than getting files back. NIST's recovery guidance emphasises the need to be able to trust the accuracy and integrity of recovered data. 

Don't Treat Ransom Payment as the Recovery Plan

When a business is unable to access its systems, paying the ransom can look like the fastest way out. But that’s not necessarily the case.

Paying the ransom doesn’t guarantee that victims will get their data back. The Australian Cyber Security Centre has advised victims never to pay ransom as it doesn’t guarantee that your files will be restored or prevent the leakage of your sensitive data.

The FBI also encourages victims to report ransomware incidents, even when they have paid the ransom. 

You should also take note of the legal and compliance issues. However, this will depend on the data privacy laws and regulations that apply in your jurisdiction. In the United States, for example, the Treasury Department has warned that ransomware payments can create sanctions risks in situations involving sanctioned individuals or entities. 

The important thing is not to build your recovery strategy around the assumption that paying the attacker will solve the problem. The ACSC recommends that you keep backups of your information as a precaution against security events like ransomware. 

Rebuild, Monitor and Learn

Once you understand the situation and have a reliable recovery point, start rebuilding the affected systems. You can follow the solution steps below:

• First, you should reset any compromised credentials and make sure the new credentials follow security best practices. Where possible, enable multi-factor authentication as an additional layer of protection.

• Then move to fixing the vulnerability or access method that allowed the attacker in.

• Remove anything that could allow them to maintain access, and make sure your security controls are working properly before reconnecting systems.

• Don't rush to put everything back online at once. Restore critical systems in a controlled way and monitor them closely.

Look for unusual authentication attempts, new accounts, suspicious processes, unexpected network connections, or anything else that suggests the attacker may still have access.

And when the immediate crisis is over, don't just move on. You need to record the lessons learned so you can reduce the chances of the same thing happening again.

Ask yourself:

• How did the attacker get in?

• How long were they in the environment?

• Were the backups actually usable?

• Did everyone know who to contact?

• Which security controls failed to detect the activity?

NIST's ransomware guidance treats response and recovery as part of a broader lifecycle. The lessons from one incident should therefore feed back into how the business prepares for the next one.

Ransomware Response Checklist

When ransomware hits, the first steps should be clear:

• Confirm and document the incident.

• Isolate affected systems.

• Preserve important evidence.

• Identify affected systems, accounts, and data.

• Check whether backups were affected.

• Bring in your IT, security, MSP, or incident-response provider.

• Notify insurance, legal, regulatory, or law-enforcement contacts where appropriate.

• Recover from a known-good backup.

• Reset compromised credentials.

• Fix the original entry point.

• Monitor systems after recovery.

• Document what happened and update the response plan.

Conclusion

Ransomware response is not about finding one command that makes the encryption disappear. It's about making the right decisions while the business is under pressure.

For an SMB, having tested backups, knowing which systems are critical, knowing who handles an incident, and having a recovery process already in place can save a lot of time when something goes wrong.

You may not be able to prevent every ransomware attack. But you can make sure that when one happens, you're not trying to figure out what to do for the first time.  

This is where having a trusted security partner like Bridgelynk can make a difference. As an organisation, preparing for ransomware security incidents requires more than implementing tools. You also need to define your critical assets and understand your security posture and whether your defences can withstand cyber attacks. 

Through our adversarial simulation testing services, we can help organisations identify exploitable weaknesses before bad actors take advantage of them. We also offer continuous monitoring, threat detection, and cybersecurity training to equip your staff with the necessary skills to mitigate against cyber threats. Request our free threat assessment consultation and speak to one of our experts. 

References

1. CISA – Accelerating Our Economy Through Better Security: Helping America’s Small Businesses Address Cyber Threats.

2. NIST IR 8374 Rev. 1 – Ransomware Risk Management: A Cybersecurity Framework 2.0 Community Profile – June 2026  https://nvlpubs.nist.gov/nistpubs/ir/2026/NIST.IR.8374r1.pdf 

3. CISA / MS-ISAC – Ransomware Guide

4. FBI – Ransomware FBI Ransomware Guidance

5. NIST SP 1800-11 – Data Integrity: Recovering from Ransomware and Other Destructive Events NIST SP 1800-11

6. U.S. Department of the Treasury / OFAC – Ransomware and Sanctions Guidance
   Treasury Ransomware Guidance

7. NIST SP 800-61r3  – Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A Cybersecurity Framework 2.0 Community Profile – April 2025 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r3.pdf