Small Office Ransomware Backup Checklist | PremiumAV

A small office may rely on one accounts computer, a shared folder and an external disk. When important files become unavailable, the immediate problem is practical: which copy can you restore, on which computer, and who knows how? A backup routine should answer those questions before an incident. A disk connected beside the PC is not enough if the same account can overwrite both copies.

This checklist focuses on backup preparation and recovery practice for Indian small businesses. For an overview of prevention, see our ransomware protection guide. Backups do not prevent stolen data or account misuse. They are one part of a wider plan that includes updates, account security, staff habits and incident response.

List the work you need to recover

Start with business tasks rather than folders alone. List accounts data, invoices, customer records, current projects, payroll and configuration needed to resume work. Ask each person where their latest files actually live. A backup of Documents may miss an application's separate data directory or a shared folder stored on another computer.

Record the application and version needed to open each important data set. Note who holds legitimate licence and recovery information, without placing passwords in an ordinary checklist. Check the application's official backup method, especially for databases or files kept open during the day. Copying an active database file is not always a usable application backup.

Choose how much work you can afford to lose

Decide how recent a restored copy must be. An office entering transactions throughout the day may need a different schedule from one updating a project weekly. Set the schedule around that need and the application's safe backup process. Describe the choice in plain language, such as restoring to the previous working evening, so staff understand its effect.

Also decide which task must resume first. Recovering invoicing may be more urgent than restoring old marketing material. Write down a realistic order and the people needed for each step. This prevents an incident from becoming a debate about priorities while the available clean computer is occupied copying low-priority files.

Keep copies with different failure paths

The 3-2-1 approach is a useful planning pattern: three copies of important data, on two kinds of storage, with one copy off site. Adapt it to the office's real circumstances. The point is to avoid one theft, damaged disk, compromised account or building incident taking away every copy at once.

Keep at least one backup offline or otherwise protected from ordinary changes on the work PCs. If you rotate external disks, disconnect a completed backup and store it securely. If you use cloud backup, check whether it provides retained versions and protected recovery points. A synchronised folder can reproduce unwanted changes; synchronisation alone is not the same as a recovery plan.

Protect access to the backups

Use separate administrative access for backup management where the service supports it. Enable multi-factor authentication for online backup accounts and limit who can delete recovery points. Do not leave backup administration signed in on a shared desk computer. Review recovery options so a lost phone does not leave the office unable to reach its only usable copy.

Encrypt portable backups containing sensitive business or personal data. Keep the recovery key in an approved separate place, with access available to the responsible person when needed. A well-encrypted backup without its recovery key cannot help during an emergency. Avoid storing the only key in the same laptop bag as the backup disk.

Check the result of each backup

Assign an owner to review completion, errors and storage capacity. A scheduled job that fails silently is not a working backup routine. Check that the most recent recovery point has the expected date and includes the intended data. Investigate repeated warnings rather than dismissing them because the application still displays a green icon elsewhere.

Keep a simple private record: backup date, destination, result, reviewer and any action needed. Exclude passwords and unnecessary customer details. Account for holidays, staff absence and the person who normally takes a disk off site. A routine that depends on one person remembering an undocumented sequence is difficult to sustain.

Test a restore before relying on it

Choose a small representative set of files and restore them into a separate test location. Do not overwrite current business records during a practice run. Open the restored documents and verify that the contents are usable. For application data, follow the supplier's test-restore procedure and confirm that the application can read the restored copy.

Record how long the process takes and what was missing. Check whether you needed an installer, a password, a recovery key or an administrator who was unavailable. Repeat after major application changes and at an interval appropriate to the business. A successful copy operation is weaker evidence than a restored file that the right application can open.

Prepare a short incident contact sheet

Write down who can authorise disconnection of PCs, who contacts technical support and who communicates with staff. Keep an accessible copy outside the shared drive that might become unavailable. Include application support and backup provider contacts obtained from their official channels. Know how to reach the bank if a finance account may be affected.

Keep the instructions short enough to use under pressure. Staff should know to report unexpected encryption, ransom notes or widespread file-access failures immediately. They should avoid experimenting with downloaded recovery tools, reconnecting backup disks or forwarding suspect attachments. See PC virus checks for slower, less urgent symptoms that need investigation.

If ransomware is suspected

Isolate affected computers from the network to limit spread and seek qualified assistance. Unplug Ethernet and disconnect Wi-Fi as appropriate. Use another trusted device or phone to coordinate help. Avoid connecting offline backups to an affected PC. Preserve the ransom note, relevant times and security alerts for the person handling the incident.

Do not rush to restore over the affected system. The entry route, affected accounts and condition of recovery points need assessment first. Rebuilding a clean system and changing exposed credentials may be part of the recovery plan. Recovery of files does not settle whether data was copied, so the business may also need professional advice about notifications and its obligations.

Make the checklist part of normal work

Review backup ownership when staff change and verify that new PCs and new data locations are included. Keep Windows, applications and the active antivirus current. Give staff a clear route to report suspicious messages; our phishing and UPI safety guide provides practical examples. The small business security page connects these habits with day-to-day administration.

For PremiumAV software, use the official download page, and review current pricing for the endpoints you need to protect. Choose backup services and security products for their documented capabilities. Most of all, practise the restore: the office needs a usable recovery path, a known owner and a copy that remains available when everyday systems are not.

Official references

CISA ransomware guide