Ransomware Protection for Small Business: A Practical Guide

Ransomware is the attack that turns a normal Tuesday into a closed office. The front desk can't check patients in. The scheduling system won't open. Every shared folder is full of files with strange extensions, and there's a note on the screen telling you to contact the attackers to "restore your data." For a dental office, a medical practice, a CPA firm or a small shop, that's days of lost revenue, a pile of legal obligations, and a very hard conversation with the people who trusted you with their information.

The good news is that ransomware is not magic. Attackers get in through a small number of predictable doors, and they need time inside your network before they can do real damage. A handful of well-run controls (multi-factor sign-in, prompt patching, modern endpoint protection, good email filtering, limited admin rights and backups an attacker can't delete) close most of those doors and make recovery fast if something does get through.

This guide explains how attacks actually happen, which defenses matter most and in what order, what to do in the first hour if you're hit, what the FBI, CISA and the Treasury Department say about paying, and how HIPAA and other rules apply. At the end there's a checklist you can work through with your IT provider.

What is ransomware, and how does it work today?

Ransomware is malicious software that locks up your files or systems, usually by encrypting them, so you can't use them until you pay for a key. (See our glossary entry on ransomware for the short version.) What has changed in the last few years is that encryption is now only half the threat.

Most modern ransomware groups run what's called double extortion: before they encrypt anything, they copy your data out. Then they demand payment twice over, once to unlock your systems and once to not publish or sell what they stole. Some skip encryption entirely and simply threaten to leak data. For a medical or dental practice, that stolen data is patient records. For a CPA firm, it's tax returns, Social Security numbers and bank details.

Here's what a typical attack looks like from the inside:

1. Getting in. The attacker logs in with a stolen password, tricks someone into running malware, or exploits an unpatched device facing the internet.
2. Looking around. They quietly map your network: which computers exist, where the file shares are, where the backups live, who the administrators are.
3. Getting more access. They look for an administrator account, often by stealing saved passwords or exploiting a computer where users are local admins.
4. Disabling defenses. They try to turn off antivirus, delete backups and shadow copies, and clear logs.
5. Stealing data. They upload copies of valuable files to their own servers.
6. Encrypting. Usually at night or on a weekend, they push the ransomware to every machine they can reach at once.
7. Demanding payment. A ransom note appears with instructions and a deadline.

The gap between step 1 and step 6 matters. In the Change Healthcare attack in 2024, UnitedHealth Group's CEO told the U.S. Senate Finance Committee that criminals used compromised credentials to access a remote-access portal that "did not have multi-factor authentication," moved through the systems and stole data, and deployed ransomware nine days later. Every one of those days was a chance to detect and stop them. Your defenses should be built to make each step harder and noisier.

How big is the ransomware threat for small businesses?

Ransomware is less common than email fraud but far more disruptive per incident, and the official numbers understate it. Here's what the most recent authoritative reports show:

• FBI IC3 2025 Internet Crime Report: The FBI's Internet Crime Complaint Center received 3,611 ransomware complaints in 2025, up from 3,156 in 2024 and 2,825 in 2023, and identified 63 new ransomware variants during the year. Reported ransomware losses were just over $32 million, but the FBI says plainly that this figure usually excludes lost business, time, wages, equipment and third-party recovery costs, and that many victims report no loss at all, which creates "an artificially low" number.
• Healthcare is a top target. The IC3 report says the ten most-reported ransomware variants in 2025 (led by Akira, Qilin and INC/Lynx/Sinobi) most affected three critical-infrastructure sectors: critical manufacturing, healthcare and public health, and government facilities.
• Small professional firms are hit too. Of the more than 1,400 ransomware complaints IC3 received from businesses outside critical-infrastructure sectors in 2025, the most-reported industries were legal services (18%), contracting services (17%) and engineering/architecture firms (10%). In other words, small professional offices.
• Verizon 2026 Data Breach Investigations Report: Ransomware was involved in 48% of all breaches Verizon analyzed, and exploited software vulnerabilities (31%) overtook stolen credentials as the most common way attackers first get in.
• IBM Cost of a Data Breach Report 2026: The global average cost of a data breach reached a record $4.99 million, and 39% of breached organizations in IBM's study reported ransomware, up from 34% the year before.
• HHS: The HHS Office for Civil Rights (OCR), which enforces HIPAA, reported in 2024 that large breaches involving ransomware had increased 264% since 2018.

You don't need to be a hospital to be on the list. Ransomware crews increasingly use automated tools that scan the entire internet for vulnerable devices and test stolen passwords at scale. They don't pick you because you're important; they pick you because a door was open.

How do ransomware attackers actually get in?

Nearly all ransomware starts through one of five entry points: phishing, stolen passwords on remote access, unpatched internet-facing devices, exposed remote desktop, or a trusted vendor's access. Knowing which ones apply to your office tells you where to spend first.

A few points worth spelling out:

• Phishing isn't just about clicking a bad attachment anymore. Many campaigns today use "adversary-in-the-middle" fake sign-in pages that capture both your password and your MFA code. We cover these in detail in our phishing and business email compromise guide.
• Remote access is the number one thing to audit. Ask your IT provider for a list of every way someone can get into your network from outside: VPN, remote desktop, remote-support tools, cloud portals. Every one needs MFA. If anyone answers "I'm not sure," that's your first project.
• Edge devices matter. Firewalls and VPN boxes sit on the internet by design. When a vulnerability is announced, attackers start scanning for unpatched devices within days. CISA maintains a Known Exploited Vulnerabilities catalog for exactly this reason.

What actually stops ransomware? The layered defense

No single product stops ransomware. What works is layers: each one blocks some attacks outright and makes the rest slower and noisier, so you catch them before encryption day. Below are the layers in roughly the order we'd prioritize them for a 5–50 person office. They also line up closely with the mitigations the FBI lists in its 2025 IC3 report and with CISA's #StopRansomware Guide.

1. Multi-factor authentication on everything that matters

Multi-factor authentication (MFA) means signing in requires something beyond a password, usually an approval in an authenticator app or a security key. (Our glossary explains MFA in two sentences.) It's the single highest-value control because the most common attack (using a stolen password) simply stops working.

Where MFA must be on, in order of priority:

1. Every administrator account, including your IT provider's
2. Email (Microsoft 365 or Google Workspace) for every user
3. VPN and any remote-access or remote-desktop gateway
4. Backup system consoles and cloud backup accounts
5. Practice-management, EHR, accounting and banking portals that support it

CISA's guide recommends "phishing-resistant MFA for all services, particularly for email, VPNs, and accounts that access critical systems." For most small offices that means the Microsoft Authenticator app with number matching today, moving administrators and key staff to passkeys or security keys over time. Our multi-factor authentication guide walks through the rollout step by step.

2. Patching, especially internet-facing devices

Patch management is the routine of installing security updates on computers, servers, apps and network devices. Verizon's 2026 DBIR finding that exploited vulnerabilities are now the top initial entry point makes this non-negotiable.

What good looks like:

• Windows and Microsoft 365 apps update automatically, with compliance reports showing which machines are behind.
• Third-party apps (browsers, PDF readers, Java, Zoom) are updated centrally, not left to staff.
• Firewalls, VPNs and Wi-Fi equipment are on supported firmware, and critical fixes go in within days.
• Nothing is running an unsupported operating system. If a PC is still on Windows 10, see our guide to Windows 10 end of support.
• Equipment that can't be patched (an old X-ray sensor PC, a lab instrument) is isolated on its own network segment.

3. Endpoint detection and response (EDR)

EDR (endpoint detection and response) is security software that watches what programs actually do on each computer, not just whether a file looks familiar. If something starts encrypting files in bulk, dumping passwords or disabling security tools, EDR can kill the process and cut the machine off from the network automatically. (More in our EDR glossary entry.)

Microsoft Defender for Business, which is included in Microsoft 365 Business Premium and designed for businesses up to 300 users, provides EDR, next-generation antivirus, automated investigation and remediation, and "automatic attack disruption," according to Microsoft Learn. Other reputable EDR products exist; what matters is that:

• It's installed on every computer and server, with no exceptions for "the old one in the back."
• Tamper protection is on, so attackers can't simply switch it off.
• Someone watches the alerts. EDR that raises an alarm at 2 a.m. on Saturday with nobody looking is a smoke detector in an empty building. At Beefed Up IT that means 24/7 monitoring and alerting with escalation to our team; ask any provider exactly who responds and how fast.

4. Email filtering and sender authentication

Most ransomware campaigns that start with a human begin in the inbox. Layered email protection includes:

• Advanced filtering that opens attachments in a sandbox and checks links when they're clicked. In Microsoft 365, that's Defender for Office 365 (Safe Attachments and Safe Links), included in Business Premium.
• SPF, DKIM and DMARC records on your domain so criminals can't easily send email that appears to come from you. Check yours with our free email security checker.
• External sender tags so staff can see when a message that looks internal actually came from outside.
• A "report phishing" button and a culture where using it is praised, not mocked.

5. Least privilege: no everyday admin rights

Least privilege means each person and system has only the access they need to do their job, nothing more. (See least privilege.) In practice:

• Staff don't sign in to their PCs as local administrators. When malware runs as a normal user, it can do far less damage.
• Administrators use a separate admin account only for admin work, never for email and web browsing.
• Shared folders are organized by role. The front desk doesn't need write access to the accounting share.
• Former employees' accounts are disabled the day they leave.
• Your IT provider's tools and accounts are themselves locked down with MFA and logging. Attackers have targeted remote-management tools precisely because they have admin access everywhere.

6. Backups that attackers can't delete

Backups are your recovery plan, and attackers know it. CISA's guide warns that "many ransomware variants attempt to find and subsequently delete or encrypt accessible backups." The FBI's 2025 IC3 report recommends that backup data be "encrypted, immutable (i.e., cannot be altered or deleted), and covers the entire organization's data infrastructure."

A ransomware-resilient backup setup has:

• The 3-2-1 rule: three copies of your data, on two different types of storage, with one copy off-site. (Our 3-2-1 backup entry explains it.)
• At least one immutable or offline copy. An immutable backup can't be changed or deleted for a set retention period, even by an administrator. That's what saves you when the attacker has stolen admin credentials.
• Separate credentials. The backup system shouldn't use the same accounts as your Windows network, and its console needs MFA.
• Cloud data included. Microsoft 365 email, OneDrive and SharePoint need their own backup; Microsoft's built-in retention is not the same thing as an independent backup.
• Tested restores. Restore real files monthly and a full system at least once or twice a year, and time how long it takes.

Our backup and disaster recovery guide goes much deeper, and the backup storage calculator helps you size it.

7. Network segmentation and locked-down remote access

Segmentation means splitting your network so that one infected device can't reach everything. For a small office that usually means separate networks (VLANs) for staff computers, servers, imaging or medical devices, phones, guest Wi-Fi and building systems like cameras. The FBI's 2025 report specifically recommends segmentation "to prevent the spread of ransomware." Combine it with:

• No remote desktop exposed to the internet, ever
• Remote access only through a gateway or VPN that requires MFA
• Vendor remote access turned on only when needed, then off again

8. Staff training and a reporting culture

People are a layer too. Short, regular training (a few minutes a month beats an hour once a year) and realistic phishing simulations help staff recognize the lures that matter. Just as important: make it easy and safe to say "I think I clicked something." The ten minutes between a click and a report can decide whether you have a minor clean-up or a full outbreak. Our free phishing quiz is a good team exercise.

9. A written incident response plan

An incident response plan is a short document that says who does what when something goes wrong: who to call, how to isolate systems, who talks to patients or clients, where the insurance policy number is. Print it. If your network is encrypted, the copy saved on your file server won't help.

How the layers compare

What ransomware protection looks like in real offices

Every office has the same core layers, but where the risk concentrates is different. Here's how we'd approach four common types of small businesses. These are illustrative profiles, not specific clients.

Dental office (8 staff, two locations of chairs, one imaging server)

The crown jewels are the practice-management database and the imaging archive. Typical weak spots: the imaging vendor's always-on remote access, an old PC attached to a sensor that can't be upgraded, and everyone sharing a front-desk login.

Priorities:

1. MFA on Microsoft 365 and on any remote access, including the vendor's (or make their access on-request only).
2. Imaging and practice-management servers backed up nightly to an immutable cloud copy, with a quarterly test restore of the database.
3. EDR on every PC and server, including the sensor PC, which also goes on its own network segment.
4. Individual logins for each staff member so you can see who did what.

Our dental practice case study shows a practice that moved patient data off unprotected local machines into encrypted cloud storage, with device management, MFA and conditional access enforced and backup and retention policies in place. That's the kind of foundation that makes ransomware a recoverable event rather than a business-ending one. Our dental office IT guide covers the rest of the setup.

Medical office (20 staff, cloud EHR, on-site file server)

With a cloud-hosted electronic health record (EHR), the EHR data itself is the vendor's to protect, but your office still holds plenty: scanned documents, referral letters, billing exports and email full of patient information. And if your PCs are encrypted, nobody can reach the cloud EHR anyway.

Priorities:

1. MFA on Microsoft 365 and on the EHR (ask the vendor; many now require it).
2. Retire or tightly lock down the on-site file server; move documents to SharePoint/OneDrive with proper permissions and independent backup.
3. Intune-managed PCs with EDR, so a wiped or infected PC can be rebuilt quickly.
4. A paper downtime procedure so clinical work continues while IT recovers. See our EHR downtime and internet failover plan.

CPA firm (12 staff, tax software, client portal)

Tax season is ransomware season: attackers know that a firm locked out in March will feel enormous pressure to pay. Client data includes Social Security numbers and bank details, which makes data theft as dangerous as encryption.

Priorities:

1. MFA on everything, including the tax software, client portal and remote access for staff working from home.
2. Immutable backups of tax data with a tested restore before January each year.
3. Least privilege on client folders; seasonal staff get only what they need and lose access at season's end.
4. A written information security plan (WISP), which the IRS expects of tax professionals and the FTC Safeguards Rule requires. More in our guide to IT security for CPA firms. Our accounting firm case study shows what a hardened, documented environment looks like.

HHS's 2025 settlement with BST & Co. CPAs, an accounting firm acting as a HIPAA business associate for a medical group, is a useful warning: OCR said the ransomware attack began with a phishing email, and found the firm had not conducted the required risk analysis. The firm agreed to pay $175,000 and adopt a corrective action plan.

Small retail shop (6 staff, point-of-sale, office PC)

Retailers often assume they're too small to matter. But a point-of-sale system that won't start on a Saturday is lost revenue you never get back.

Priorities:

1. Keep the point-of-sale network separate from the office PC and the guest Wi-Fi.
2. MFA on email, the POS cloud dashboard, the bank and the payroll provider.
3. EDR on the office PC (the one used for email and web browsing is the most likely entry point).
4. Back up the POS configuration, product database and accounting files, with a cloud copy.

What should you do in the first hour if you're hit by ransomware?

Isolate, don't panic, and call for help before you change anything else. The steps below follow CISA's #StopRansomware response checklist, adapted for a small office.

1. Disconnect affected computers from the network. Unplug the network cable and turn off Wi-Fi. If many machines or the server are affected, disconnect the internet at the firewall or switch. CISA advises powering devices down only if you can't disconnect them, because shutting down destroys evidence in memory.
2. Don't wipe, restore or "clean up" yet. Restoring backups onto a network where the attacker still has access can get your backups encrypted too.
3. Photograph the ransom note and any unusual screens. Note the time, what you saw and who saw it.
4. Call your IT provider's emergency line. They should begin containment: isolating machines with EDR, disabling compromised accounts, and checking whether backups are intact.
5. Use out-of-band communication. CISA recommends using phone calls rather than your possibly compromised email to coordinate, so you don't tip off the attackers.
6. Call your cyber insurer's breach hotline before you hire anyone else. Many policies require you to use their approved incident response firm and lawyer ("breach coach"), and acting first can jeopardize coverage.
7. Reset credentials from a clean device, starting with administrator accounts, and revoke active sign-in sessions in Microsoft 365. A password change alone doesn't kick out an attacker who has stolen a session token.
8. Report to law enforcement. File at IC3.gov and contact your local FBI field office, and report to CISA. The FBI encourages reporting whether or not you pay.
9. Start your activity log. Record every decision and action with times. Your lawyer, insurer and, for healthcare, HHS may all ask for it.
10. Activate downtime procedures. Paper schedules, phone scripts for patients or clients, manual card terminal if you have one.

The first days and weeks

After containment, the work shifts to investigation and recovery:

• Forensics determine how the attacker got in, what they touched and whether data was stolen. This answer drives your legal notification duties.
• Eradication removes the attacker's access: malware, backdoor accounts, remote tools they installed, and the original entry point.
• Recovery restores systems from known-good backups or rebuilds them from scratch, starting with the most critical (practice management, EHR access, email).
• Notification to patients, clients, regulators and possibly the media, guided by your lawyer.
• Lessons learned: close the door they came through, and update the plan.

Use our downtime cost calculator to estimate what each day of recovery would cost your office. The number usually makes the case for prevention by itself.

Should you pay the ransom?

U.S. authorities' guidance is clear: don't pay if you can possibly avoid it, and never decide alone. The FBI says it "does not support paying a ransom," CISA strongly discourages payment, and the Treasury Department's Office of Foreign Assets Control (OFAC) warns that paying certain groups may violate U.S. sanctions.

What each agency says

• FBI: Paying "does not guarantee an organization will regain access to their data," some victims "were never provided with decryption keys after having paid," and payment "emboldens the adversary to target other organizations." The FBI asks victims to report either way.
• CISA: Its #StopRansomware resources focus on prevention and recovery so you're never in the position of needing to pay, and federal partners have repeatedly said they do not encourage payment.
• OFAC (Treasury): In its September 21, 2021 updated advisory, OFAC said the U.S. government "strongly discourages all private companies and citizens from paying ransom or extortion demands." Paying a person or group on the sanctions list can be a violation even if you didn't know who they were. OFAC treats meaningful preventive security steps (it specifically points to CISA's recommended practices) and prompt, full reporting to and cooperation with law enforcement as significant mitigating factors.

Why paying often doesn't solve the problem

Change Healthcare's parent company did pay. Its CEO told the Senate that "the decision to pay a ransom was mine." Yet the incident still became one of the largest health data breaches ever reported to HHS. Payment didn't undo the data theft.

If you're seriously considering paying

Some organizations end up there, typically when backups are gone and the business can't survive the downtime. If that's you:

1. Talk to your insurer and their breach counsel first. Many policies require insurer consent before any payment.
2. Involve the FBI. They may have intelligence on the group, and possibly a decryptor.
3. Have counsel check the group and payment path against OFAC sanctions.
4. Let professionals negotiate and handle any transaction. Don't contact the attackers yourself.
5. Keep recovering from backups in parallel. Don't bet everything on the key.

The real answer to "should we pay?" is decided months earlier, by whether you have immutable, tested backups. Organizations with them rarely face the question.

What does HIPAA say about ransomware?

For medical and dental practices, a ransomware attack is presumed to be a reportable HIPAA breach unless you can prove otherwise. HHS's ransomware fact sheet says that when electronic protected health information (ePHI) is encrypted by ransomware, a breach has occurred because the information was "acquired," meaning unauthorized people took possession or control of it, which is a disclosure the Privacy Rule doesn't permit.

The presumption can be overcome only if you document a low probability that the PHI has been compromised, using the four factors in the Breach Notification Rule:

1. The nature and extent of the PHI involved (types of identifiers, likelihood of re-identification)
2. The unauthorized person who used the PHI or to whom it was disclosed
3. Whether the PHI was actually acquired or viewed
4. The extent to which the risk has been mitigated

If you can't make that case, the Breach Notification Rule requires:

• Notice to affected patients without unreasonable delay and no later than 60 days after discovery.
• Notice to HHS: within 60 days if 500 or more people are affected; for smaller breaches, in an annual log submitted within 60 days after the end of the calendar year.
• Notice to prominent media if more than 500 residents of a state or jurisdiction are affected.

Florida adds its own clock. Florida Statute 501.171 requires notice to affected individuals no later than 30 days after determining a breach, and notice to the Florida Department of Legal Affairs if 500 or more Floridians are affected. HIPAA-covered entities that notify under HIPAA can be deemed compliant if they also send the department a copy. Your lawyer should map both timelines on day one. Our HIPAA breach response plan guide walks through it.

OCR enforcement is focused on ransomware and risk analysis

OCR has made ransomware a clear enforcement priority. In June 2026 it announced a settlement with the Spencer Gifts health plans that it described as its 20th ransomware enforcement action and the 14th under its Risk Analysis Initiative, which targets organizations that never did the required HIPAA risk analysis. The recurring finding across these cases isn't "you got hit"; it's "you hadn't assessed your risks or put reasonable safeguards in place before you got hit."

That's why your HIPAA security risk assessment should explicitly cover ransomware: where ePHI lives, how it's backed up, how fast you could restore it, and what stops an attacker from reaching it.

The proposed HIPAA Security Rule changes

HHS published a proposed overhaul of the HIPAA Security Rule on January 6, 2025. It would make controls like MFA, encryption, network segmentation, written incident response plans and the ability to restore systems within 72 hours explicit requirements. As of this writing (October 2026), the rule is not final; HHS's regulatory agenda points to final action no earlier than mid-2027. Check HHS for the latest status, and see our summary of the proposed HIPAA Security Rule changes. Either way, the proposed controls are already what insurers, OCR investigators and common sense expect.

Other rules that may apply

• CPA and tax firms covered by the FTC Safeguards Rule must notify the FTC no later than 30 days after discovering a security event involving unencrypted information of 500 or more consumers. That requirement took effect May 13, 2024.
• Business associates (billing companies, IT providers, accountants handling PHI) must notify the covered entity, which then handles patient notice.
• Contracts with larger clients often include their own notification deadlines, sometimes as short as 24–72 hours.

What does ransomware protection cost?

For most small offices, the core tools are less expensive than people expect, because many of them are already included in licensing you may already pay for. The real costs are setup, ongoing management and someone watching the alerts.

We deliberately haven't listed Microsoft list prices here because they change; check current pricing, and see our Microsoft 365 plan comparison for what each plan includes. For a sense of total managed IT cost, see our managed IT services cost guide.

The comparison that matters is against a week of closed doors plus breach notification, legal fees and forensics. IBM's 2026 report puts the global average cost of a breach at $4.99 million. A small practice's bill is far smaller, but so is its ability to absorb it.

Mistakes we see that make ransomware worse

These are the patterns that turn a contained incident into a disaster:

• Backups on the same network with the same passwords. The attacker finds them and deletes them first.
• "We have backups" that nobody has restored. The first restore attempt shouldn't be during an attack.
• MFA on email but not on remote access. Attackers use whichever door is unlocked.
• Everyone is a local admin because one program once needed it.
• EDR alerts going to an inbox nobody reads, or to the office manager's phone at 3 a.m.
• An old firewall nobody has logged into in years, running firmware with published vulnerabilities.
• The vendor's always-on remote access with a shared password that hasn't changed since installation.
• No paper copy of the incident plan, insurer hotline or IT emergency number.
• Reformatting infected PCs immediately, destroying the evidence you need to determine whether patient data was stolen.
• Answering insurance applications optimistically. If the application says you have MFA everywhere and you don't, a claim can be denied. See our cyber insurance requirements checklist.

Questions to ask your IT provider about ransomware

Use these to check whether you're really protected, or to compare providers (also see how to choose a managed IT provider):

1. Can you show me a list of every account with admin rights, and confirm each one has MFA?
2. What are all the ways someone can access our network from outside, and is each protected by MFA?
3. Is EDR installed on every computer and server? Who watches the alerts at night and on weekends, and what happens when one fires?
4. Is at least one copy of our backups immutable or offline? Who can delete it?
5. When did you last do a test restore, how long did it take, and can I see the result?
6. How long would it take to get our front desk working again if every PC were encrypted tonight?
7. Are our firewall and VPN on supported, current firmware? How quickly do you apply critical fixes?
8. Do any staff have local admin rights? Why?
9. How is vendor remote access controlled and logged?
10. Do we have a written incident response plan, and when did we last walk through it?

Ransomware readiness checklist

Work through this list with your team or IT provider. Every "no" is a project.

Identity and access

• MFA required for every user on email and cloud apps
• MFA required for every admin account, including the IT provider's
• MFA on VPN, remote desktop gateways and remote-support tools
• Legacy sign-in protocols that bypass MFA are blocked
• No staff sign in as local administrators day to day
• Separate admin accounts used only for admin tasks
• Departed staff disabled the same day

Devices and patching

• EDR on every PC and server, with tamper protection on
• EDR alerts monitored 24/7 with a defined escalation path
• Windows and apps patched automatically; compliance reported monthly
• Firewall, VPN and Wi-Fi firmware current and supported
• No unsupported operating systems, or isolated and documented if unavoidable
• Full-disk encryption (BitLocker) on all laptops and desktops

Email

• Advanced filtering with attachment sandboxing and link checking
• SPF, DKIM and DMARC configured for your domain
• External sender tagging turned on
• One-click phishing report button available to staff

Backups and recovery

• 3-2-1 backups covering servers, PCs where data lives, and Microsoft 365
• At least one immutable or offline copy
• Backup console protected by separate credentials and MFA
• Monthly file restore tests; full system restore tested at least twice a year
• Documented recovery time for critical systems

Network

• No remote desktop exposed directly to the internet
• Guest Wi-Fi separate from business network
• Medical/imaging devices, POS and cameras on separate segments
• Vendor remote access enabled only on request, then disabled

People and plans

• Short, regular security training for all staff
• Phishing simulations at least quarterly
• Written incident response plan, printed, with phone numbers
• Cyber insurance policy number and breach hotline in the plan
• Tabletop exercise held in the last 12 months
• HIPAA risk assessment (or WISP for CPA firms) covers ransomware

The bottom line

Ransomware succeeds against small businesses for boring reasons: a password without MFA, a firewall that wasn't patched, an admin account used for email, backups that could be deleted. Fix those, put EDR on every machine with someone watching it, and keep backups the attacker can't touch, and ransomware becomes a bad day instead of a business-ending month.

If you'd like a second set of eyes, we'll review your remote access, MFA coverage, backups and EDR and give you a plain-English list of what to fix first. Learn more about our managed IT and security services and our work with healthcare practices, or book a free 20-minute call.