Ransomware recovery is measured by preparation.
If your business has clean, isolated, tested backups and a documented response plan, you may restore critical operations within 24 to 72 hours. Full recovery can still take several days. For a more complex environment, seven to fourteen days is a realistic planning range.
If your backups are connected to the production network, untested, incomplete, or already compromised, recovery can take weeks. Some businesses never recover all their data.
There is no honest way to guarantee that every ransomware incident will be resolved in hours. Attack scope, attacker dwell time, backup quality, system complexity, and legal obligations all affect the outcome. But you can dramatically improve your position with the right controls and a disciplined first 24 hours.
WHAT RANSOMWARE RECOVERY REALLY INVOLVES
Ransomware recovery is not simply decrypting files.
A complete recovery usually includes:
- Stopping the attack from spreading.
- Protecting backup systems from further damage.
- Identifying the initial access point.
- Preserving evidence for investigation and insurance claims.
- Rebuilding compromised systems.
- Resetting credentials and removing malicious access.
- Restoring clean data in the right order.
- Validating that systems are safe before reconnecting them.
- Communicating with employees, customers, vendors, regulators, and law enforcement when necessary.
The Cybersecurity and Infrastructure Security Agency (CISA) recommends isolating affected systems, preserving evidence, coordinating with response partners, and restoring from clean offline backups only after the environment has been cleaned and rebuilt.
The National Institute of Standards and Technology (NIST) takes the same practical view. Recovery requires planning, backup integrity checks, prioritized restoration, and lessons learned after the incident.
YOUR FIRST 24 HOURS AFTER A RANSOMWARE ATTACK
The first day determines how much damage the attack causes. Move quickly, but do not make decisions that destroy evidence or compromise your remaining backups.
HOURS 0–4: CONTAIN THE ATTACK
Start with containment.
- Isolate affected devices. Disconnect infected workstations, servers, and storage systems from wired and wireless networks. If you cannot isolate them individually, your IT team may need to disable network segments or switches.
- Protect your backup infrastructure. Disconnect backup appliances, repositories, and removable media from the affected environment. Disable access that the attacker could use to encrypt or delete backups.
- Use alternate communications. Assume company email, chat, and VoIP may be compromised. Use personal phones or another trusted communication channel for the response team.
- Do not casually wipe or reboot systems. Some systems should remain powered on so responders can preserve memory, logs, and other forensic evidence. Follow the direction of your incident response provider, insurer, or legal counsel.
- Activate your response plan. Notify leadership, your managed IT services provider, cyber insurance carrier, legal counsel, and incident response specialists.
Do not spend the first hours trying random decryption tools or negotiating with attackers. First, stop the spread and preserve your options.
HOURS 4–12: DETERMINE WHAT IS CLEAN
Once the attack is contained, establish the scope.
Your response team should identify:
- Which endpoints, servers, virtual machines, and cloud workloads are affected.
- Which user and administrator accounts may be compromised.
- Whether shared drives and backups were encrypted or deleted.
- When the attacker first gained access.
- Whether data was copied before encryption.
- Which systems are essential for daily operations.
- Whether critical vendors or customers may be affected.
This is where recovery point objectives and recovery time objectives become practical.
- Recovery Point Objective (RPO): How much recent data can you afford to lose? An RPO of four hours means you need a clean restore point no more than four hours old.
- Recovery Time Objective (RTO): How long can a service remain unavailable? Your accounting platform, email, production system, and customer portal may each have different RTOs.
Do not assume the newest backup is the best backup. If attackers were inside your environment for several weeks, recent backups may contain compromised files or attacker-created accounts.
Review backup logs, access records, endpoint alerts, identity provider activity, firewall logs, and cloud audit trails. The goal is to identify the most recent known-clean recovery point.
HOURS 12–24: CHOOSE THE RECOVERY PATH
By the end of the first day, you should have a documented recovery decision.
The usual options are:
- Restore from verified clean backups. This is generally the preferred path when backups are available and intact.
- Use a reputable decryptor. A decryptor may exist for some ransomware variants. Your incident response team or law enforcement can help determine whether one is legitimate and safe.
- Rebuild systems manually. This may be necessary when backups are incomplete, compromised, or unavailable.
- Evaluate ransom demands with experts. Payment does not guarantee decryption, prevent data publication, or remove attacker access. Any decision must involve legal counsel, your insurer, and qualified incident response professionals.
Recovery should happen on clean infrastructure. Rebuilding or re-imaging compromised systems is usually safer than trying to “clean” them in place. Restore identity services, DNS, and core infrastructure before reconnecting dependent applications and endpoints.
BACKUPS THAT ACTUALLY WORK
A backup is not useful because a dashboard says “successful.” It is useful because you can restore the right data, within the required timeframe, without reintroducing malware.
A ransomware-resistant backup strategy should include the following.
USE MULTIPLE COPIES AND LOCATIONS
The traditional 3-2-1 approach remains a useful baseline:
- Keep at least three copies of important data.
- Store those copies on at least two different types of media or systems.
- Keep at least one copy offline or isolated from the production network.
For many SMBs, this may include local recovery for speed, encrypted cloud storage for offsite protection, and an immutable or offline copy for worst-case recovery.
MAKE AT LEAST ONE COPY IMMUTABLE OR OFFLINE
If an attacker can access your backup console with stolen administrator credentials, the backup may not be a backup for long.
Use controls such as:
- Immutable retention periods.
- Offline or air-gapped storage.
- Separate backup administrator accounts.
- Multi-factor authentication.
- Network segmentation.
- Restricted management access.
- Alerts for mass deletion, encryption, or unusual backup activity.
Cloud storage can be part of a resilient design. It is not automatically isolated. Your cloud strategy should account for identity security, access permissions, retention, recovery speed, and provider dependencies.
TEST RESTORES REGULARLY
Test restores are the difference between confidence and guesswork.
At minimum, verify that you can restore:
- A single file.
- A complete folder or shared drive.
- A critical application database.
- A virtual machine or server.
- Identity and authentication services.
- A complete business workflow.
A quarterly restore test is a reasonable starting point for many SMBs. More critical environments may need monthly testing. Record how long each restoration takes, what failed, and what needs to change.
PROTECT BACKUP CREDENTIALS
Backup systems should not share unrestricted administrator credentials with everyday user accounts. Use separate accounts, MFA, privileged access controls, and monitored administrative sessions.
Also verify that backup agents, service accounts, and cloud applications cannot write freely to every backup location. Limiting access reduces the chance that one stolen credential destroys your entire recovery plan.
REALISTIC RECOVERY TIMELINES FOR SMBs
Your recovery timeline depends on the environment you have before the attack.
Environment condition | Critical systems | Full recovery | ||
|---|---|---|---|---|
Clean, isolated, tested backups; simple environment | 24–48 hours | 1–3 days | ||
Tested backups; several servers and business applications | 1–3 days | 3–7 days | ||
Larger or hybrid environment requiring rebuilds and validation | 2–5 days | 5–14 days | ||
Compromised, missing, or untested backups | Uncertain | Several weeks or longer | ||
These are planning ranges, not promises. Data transfer capacity, hardware availability, application dependencies, third-party vendors, and evidence-preservation requirements can add time.
Your goal should be to restore critical business functions first, not every device at once. For example, restoring authentication, financial systems, production applications, and essential file shares may matter more than restoring an unused department server.
HOW TO PREPARE BEFORE AN ATTACK
Ransomware recovery is far easier when responsibilities are clear before anyone sees an encryption notice.
Document:
- Who can declare a security incident.
- Who contacts your insurer and legal counsel.
- Which systems are mission-critical.
- Where recovery documentation is stored offline.
- How to access backup consoles during an outage.
- Which vendors provide emergency support.
- What your RPO and RTO targets are.
- How employees should communicate during an incident.
- When customers, regulators, or law enforcement must be notified.
This is an area where cybersecurity consulting can provide practical value. A good assessment should produce more than a list of vulnerabilities. It should give you a prioritized recovery roadmap, clear ownership, and exercises that test whether the plan works.
GET HELP WITHOUT LOSING CONTROL
Most SMBs do not need to build a full security operations center. They do need reliable preparation, protected backups, and access to specialists when an incident occurs.
The right small business IT support partner should help you:
- Design and monitor resilient backups.
- Test recovery procedures.
- Secure privileged accounts.
- Build an incident response plan.
- Coordinate technical and business priorities.
- Transfer knowledge to your internal team.
Ongoing managed IT services for small business can also provide continuous monitoring, patching, endpoint protection, identity controls, and backup oversight. These services do not eliminate ransomware risk. They reduce the chance that a preventable gap becomes a business-ending outage.
The objective is not dependency. Your team should understand the plan, know the priorities, and have access to the information needed to make decisions.
START WITH AN HONEST RECOVERY CONVERSATION
You do not need to wait for an attack to find out whether your backups work.
Ask:
- What is our most recent verified clean restore point?
- Can we restore our critical systems within 24 to 72 hours?
- Can an attacker delete or encrypt our backups?
- Who has administrative access to the backup platform?
- When did we last perform a full restoration test?
- What happens if our primary cloud or IT provider is unavailable?
- Who leads the first 24 hours of an incident?
If you do not have clear answers, start there. Five 9 can review your current environment, identify the highest-impact gaps, and recommend a practical recovery plan. There is no pressure to commit to a long-term arrangement. Contact us for a straightforward conversation about your risks, recovery targets, and next steps.
The best time to plan ransomware recovery is before you need it. The next best time is today.