Backups that survive ransomware

A backup that has never been tested is an assumption, not a recovery plan. The difference matters most on the day the business needs the backup.

Ransomware is malicious software that blocks access to a business's systems or files, usually by encrypting them, until a payment is made. Ransomware is why a tested backup now matters more than it used to. The most recent small-business ransomware share that Verizon's Data Breach Investigations Report (DBIR) has published is in its 2025 DBIR Small- and Medium-Sized Business Snapshot. In it, ransomware was a component of 88 percent of confirmed breaches at organizations with fewer than 1,000 employees, against 39 percent at large organizations. Verizon's commentary on the gap is worth quoting: it is "simply a bonus for the attacker that SMBs are less likely to have up-to-date and readily available backups than a large organization." The 2026 DBIR puts ransomware in 48 percent of all breaches, up from 44 percent the year before. It also finds small organizations "disproportionally impacted by Ransomware." The FBI's Internet Crime Complaint Center (IC3) recorded more than 1,400 ransomware complaints during 2025 from businesses outside the critical infrastructure sectors. Critical infrastructure sectors are the industries the government treats as essential, such as energy and healthcare. Legal services, contracting, engineering and architectural firms, and consultancies led the list (2025 IC3 Annual Report).

A business with a working, tested, out-of-reach backup has an expensive and unpleasant week. A business without one is negotiating with criminals over its own records.

Sync is not backup

This is one of the most consequential misunderstandings in small business IT, and an understandable one.

File sync services such as OneDrive, Google Drive, Dropbox, and SharePoint are designed to make the same files appear on every device. That is their purpose and they do it well. It also means that when a file is encrypted, corrupted, or deleted, the service copies that change to every synced device and to the cloud, where it can overwrite the good copies (CISA #StopRansomware Guide).

These platforms offer version history and a recycle bin, which help with an accidental deletion. Both are limited in scope and duration, and neither is designed to withstand an attacker operating inside the account. Check what their retention recovers, and for how long. Where that falls short of what a ransomware recovery would demand, add a dedicated backup for the platform.

A backup differs in three ways. It is a separate copy rather than a synced one. It retains history, so the business can return to a point before the damage. It also sits somewhere the compromise of everyday accounts does not reach.

The three properties that matter

Automatic. A backup that depends on a member of staff remembering will eventually not happen, and it will stop quietly. Set backups to run on a schedule covering all the business's important data, and confirm periodically that they are still running. NIST's small business guidance puts both halves in one instruction: "regularly backing up your data and testing your backups" (NIST SP 1300). The common shorthand for coverage, the 3-2-1 approach, is a reasonable target: three copies, on two types of media, with one kept off-site.

Out of reach. This is the property ransomware attacks and the one most often missing. Most ransomware groups try to find and delete or encrypt any backups they can reach, so that the business cannot restore without paying (CISA #StopRansomware Guide). Stolen sign-ins are a common route: where the backup service accepts the same sign-in as everything else, reaching one administrator reaches the copies too.

The defense is at least one copy held offline or in immutable storage. Immutable storage keeps a copy that cannot be altered or deleted for a defined period, even by a person holding valid credentials. The FBI's ransomware guidance is specific, recommending off-site or offline backups that are encrypted and immutable and cover the entire organization's data (2025 IC3 Annual Report). Then check which account opens the backup console. The console is the screen where the backup service is managed. If it is an ordinary work login, move it to a credential that exists nowhere else, with its own multi-factor authentication and a short list of named staff who hold it. Multi-factor authentication is a second check at sign-in beyond the password.

Tested. A restore that has never been performed is an assumption. Run one twice a year and record what was restored, how long it took, and who ran it. That answers two questions at once: whether recovery works, and how much downtime to expect.

A realistic setup

Identify what would stop the business from operating: email, accounting, the customer database or industry application the business could not operate without, payroll records, and the shared files staff work from daily. Anything the business could rebuild in an afternoon is a lower priority.

Cover the cloud platforms with a dedicated backup rather than relying on the platform's own retention. Cover the systems outside the cloud as well. Examples include the server in a closet, the machine running one business application, and the single laptop holding twenty years of drawings. Those are the systems most often forgotten and most often the reason a recovery fails.

Make one copy immutable or offline. Many business backup services offer immutable retention as a setting, so check for it and turn it on. Where that is unavailable, a rotated external drive kept disconnected and off-site is legitimate, provided a named member of staff rotates it as scheduled.

Protect the backup separately: its own credentials, its own multi-factor authentication, encryption at rest, and access limited to the smallest sensible number of staff. Encryption at rest keeps the stored copies unreadable without the key. The guide to rolling out multi-factor authentication covers the administrative accounts that this protection depends on.

Then put two dates in the calendar. One is to confirm that backups are running and covering what the business thinks they cover. The other is to perform a restore test and record the result.

If an outside IT provider handles the business's systems, ask the provider three questions and keep the answers in writing: what is covered, whether any copy is immutable or offline, and when a restore was last tested. If the agreement covers the help desk only, ask about a full restore of the main system. Ask what it would cost, how long it would take, and how quickly the provider would begin. A price and a start time agreed before an incident are worth more than the same conversation held during one.

What a tested restore is worth

It changes the insurance conversation. Backup questions appear on most cyber insurance applications, and many ask whether a restore has been tested. A dated restore record lets the business answer that question with a yes it can support. The guide to answering a cyber insurance questionnaire covers what else insurers ask.

It also changes the incident conversation. A ransom demand has the most leverage when, at the moment of decision, the owner cannot say how long recovery would take or whether it would work. A business that tested a restore in March knows the answer in November, and knowing the answer is what makes refusing possible. Across all organizations in the 2026 DBIR dataset, 69 percent of ransomware victims did not pay, up from 64 percent in the 2025 dataset.

Where to start

If the owner is not certain whether the backups are running, that uncertainty is itself the finding. Confirm it this week, and if the answer is no, it is the highest-value item on the business's list.

To see how backups sit alongside everything else the business might improve, start with the free health check. It is ten questions in the browser, needs no account, and names up to three areas to look at first. A full assessment then sets out the order of every improvement, and the small business guide to cybersecurity assessments explains what one involves.