Ransomware: Prevention and Response for Small Businesses

Ransomware is malicious software that locks up your computers or files until you pay. The FBI's Internet Crime Complaint Center (IC3) describes it as malware "designed to block access to a computer system until money is paid." The Treasury Department notes that in some cases attackers also threaten to publish victims' sensitive files, so a good backup alone may not end the extortion.

Small businesses are not too small to be targeted. The IC3's 2025 annual report says it received more than 3,600 ransomware complaints that year, with reported losses exceeding $32 million. The FBI notes that this figure usually leaves out lost business, staff time and outside recovery costs. More than 1,400 of those complaints came from organizations outside critical infrastructure sectors, led by legal services, contracting services such as electricians and general contractors, and engineering and architectural firms.

This guide summarizes the federal government's main ransomware guidance for a small business. It is general information, not legal advice; payment and notification decisions should involve an attorney.

How Attackers Get In

The #StopRansomware Guide, written jointly by CISA, the FBI, the NSA and the Multi-State Information Sharing and Analysis Center, organizes its prevention advice around common initial access routes:

• Internet-facing vulnerabilities and misconfigurations, such as unpatched VPNs and firewalls
• Compromised credentials, such as reused or stolen passwords
• Phishing emails
• Precursor malware already on a machine
• Advanced social engineering
• Third parties and managed service providers with access to your systems

Closing these doors is the core of prevention.

Prevention: The Controls That Matter Most

The guide and the FBI's recommendations overlap heavily. For a small business, prioritize:

• Backups you can trust. The guide calls for offline, encrypted backups of critical data that are tested regularly, and warns that many ransomware variants try to find and delete or encrypt accessible backups. The FBI advises keeping backups disconnected from the computers and networks they back up, and its 2025 report recommends backups that are encrypted and immutable, meaning they cannot be altered or deleted.
• Multifactor authentication. The guide recommends phishing-resistant MFA for all services, particularly email, VPNs and accounts that access critical systems.
• Patching. The FBI's report calls timely patching "one of the most efficient and cost-effective steps" an organization can take, and says to prioritize known exploited vulnerabilities in internet-facing systems.
• Remote access. The guide says to limit Remote Desktop Protocol and similar services, and to apply safeguards such as MFA and account lockouts where they are necessary, because attackers often get in through exposed and poorly secured remote services.
• Least privilege. Give people only the access they need, and audit administrator accounts.
• Endpoint protection. The guide recommends application allowlisting and endpoint detection and response tools; the FBI adds network segmentation to limit how far an infection spreads.
• Email hygiene and training. The guide suggests flagging external emails, disabling macros in Office files from the internet, and running security awareness training.

For backup design, see our guide Backups and Disaster Recovery: RPO, RTO and Restores That Work.

Prepare Before It Happens

The guide recommends that organizations "create, maintain, and regularly exercise a basic cyber incident response plan" with a communications plan, and keep a hard copy and an offline version, since an attack may take down the systems where the plan normally lives.

Your ransomware-ready contact list should include your IT provider, your cyber insurer, your attorney, your bank, and the federal contacts the guide names: CISA, your local FBI field office and the FBI's IC3. Store phone numbers somewhere that does not depend on your email or network. Our guide Incident Response Planning for Small Businesses walks through building that plan.

The First Hours: CISA's Response Checklist

If you suspect ransomware, the guide's checklist starts with these steps:

1. Determine which systems were impacted and immediately isolate them, for example by unplugging network cables or disabling Wi-Fi.
2. Power devices down only if you cannot disconnect them from the network. The guide notes this destroys evidence held in memory, so it is a last resort.
3. Triage systems for restoration based on how critical they are to the business.
4. Preserve evidence such as logs, memory captures and malware samples.
5. Report the incident to CISA, your local FBI field office or the IC3, and follow the notification steps in your plan, including your cyber insurer.
6. Research whether a decryption tool exists for the variant. Law enforcement may know of one.
7. Rebuild affected systems from clean images, reset credentials, and restore data from offline backups only after the environment is clean.

Communicate by phone or another separate channel if email may be compromised. The guide also points to state breach notification laws and health-data breach rules when personal information has been exposed. If data was stolen, talk to your attorney about notification duties.

Should You Pay?

Federal agencies are clear about their position. The IC3 states: "The FBI does not support paying a ransom in response to a ransomware attack," noting that payment does not guarantee recovery and encourages attackers to target others.

The Treasury Department's Office of Foreign Assets Control (OFAC) adds a legal dimension. Its September 21, 2021, advisory says the US government "strongly discourages all private companies and citizens from paying ransom or extortion demands." It warns that payments to sanctioned people or places may violate OFAC regulations, and that OFAC may impose civil penalties based on strict liability, meaning even if you did not know the recipient was sanctioned. OFAC treats prompt reporting to law enforcement and full cooperation as significant mitigating factors.

Any payment decision belongs to leadership, made with your attorney, your insurer and law enforcement. This is not a decision for the IT person alone.

What to Include in a Report

The IC3 asks for details such as the ransomware variant name if known, the file extension of encrypted files, the cryptocurrency type and address, the attackers' email addresses and websites, the ransom amount, and whether you paid and how much. Save ransom notes and screenshots so you can supply these details.

After Recovery

Find and fix how the attackers got in before declaring the incident over, or you risk being hit again. Hold a short lessons-learned review, update your plan and contact list, and run a tabletop exercise in which leaders talk through a ransomware scenario before the next real one.

Key takeaways

• Ransomware reports to the FBI include many small professional and trade businesses, not just large enterprises.
• Offline, encrypted, tested backups, phishing-resistant MFA, prompt patching and locked-down remote access do most of the prevention work.
• Isolate affected systems first and power down only as a last resort, because shutting down destroys evidence.
• Report to CISA, the FBI or the IC3, and involve your insurer and attorney early.
• The FBI does not support paying, and Treasury warns that payments can carry sanctions risk.

Sources

• CISA, MS-ISAC, NSA and FBI, #StopRansomware Guide
• FBI IC3, Ransomware
• FBI IC3, 2025 IC3 Annual Report
• US Treasury OFAC, Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments (September 21, 2021)