Ransomware can disrupt more than computers. It can prevent employees from accessing essential files, interrupt customer service, and put critical business operations on hold. A recovery plan helps you respond in an organized way, protect the evidence you may need, and restore the services your business depends on.
Your plan should connect cybersecurity incident response with business continuity and disaster recovery (BCDR). Backups are essential, but they are only one part of recovery: your team also needs to know what to restore, in what order, who makes decisions, and how you will communicate.
Here is a practical way to build that plan for your Colorado business.
1. Assign incident roles and decision authority
Before an incident, name the person who will coordinate the response and identify alternates. That person should know who to contact and have authority to bring the right people together.
Depending on your organization, the response team may include:
- An executive decision-maker and incident coordinator
- Your IT team or managed service provider (MSP)
- Business-unit leaders who understand operational priorities
- Legal counsel, privacy contacts, and your cyber insurer
- Communications, finance, and human resources representatives
Write down who can authorize network isolation, emergency spending, customer communications, and decisions about outside response support. Keep contact details available outside your normal IT environment (for example, in a secure offline document) so they remain accessible if email or business systems are unavailable.
The CISA #StopRansomware Guide recommends preparing incident response and communications procedures in advance. Adapt its guidance to your organization, vendors, and insurance requirements.
2. Identify what must come back first
Start with business services, not a list of devices. Ask what your team needs to keep serving customers and operating safely. This could include identity and network services, payroll, order processing, accounting, databases, cloud applications, or customer support systems.
For each service, document its owner, key dependencies, backup location, and recovery targets:
- RTO (recovery time objective): your target for how long the service can be unavailable.
- RPO (recovery point objective): how much recent data your business can afford to lose, expressed as time.
For example, a business might set a four-hour RTO and one-hour RPO for a critical transaction system, but a 24-hour RTO and 24-hour RPO for payroll. These are planning examples, not universal targets. Choose objectives based on the impact of downtime and data loss, then verify that your people, backup systems, and providers can meet them.
List service dependencies as well. A database may be backed up, but restoring the application that uses it may also require identity services, encryption keys, network settings, or licenses. Understanding those connections helps you plan a workable recovery order.
3. Make backups difficult to reach, and practical to restore
A backup is useful only if it is available, current, and safe to restore. Ransomware may encrypt or delete backups that are reachable from compromised systems, so do not rely on a single backup copy or a continuously synchronized folder.
A commonly used starting point is the 3-2-1 approach: keep three copies of important data, on two types of storage, with one copy stored separately from the primary environment. For ransomware resilience, make sure at least one copy is offline or otherwise isolated from routine access. Where appropriate, use immutable backups: copies that cannot be changed or deleted during a defined retention period.
Consider these safeguards as part of your BCDR design:
- Use separate, protected administrator accounts for backup systems, with multifactor authentication and limited permissions.
- Protect backup copies with encryption and keep recovery keys accessible through a separate, secure process.
- Confirm that backups cover the systems and information needed to rebuild, including databases, cloud services, configurations, and essential documentation.
- Keep a record of how to access backup consoles and contact backup providers if normal identity or email systems are unavailable.
- Check whether backup copies are completing successfully and whether retention settings protect them from early deletion.
CISA’s ransomware guidance recommends maintaining offline, encrypted backups and regularly testing them. Your backup schedule should reflect the RPO you have set, not just what is convenient to configure.
4. Write down first-response actions
People should not have to improvise under pressure. Create a short ransomware response checklist and make it available offline. Include steps such as:
- Activate the response team and record the time, symptoms, affected systems, and actions taken.
- Isolate affected devices or network segments to limit spread. If you are unsure how to isolate a critical system safely, contact your IT or incident response provider.
- Protect backup systems and accounts by limiting access and following your organization’s containment procedures.
- Preserve evidence. Keep ransom notes, suspicious messages, relevant logs, and a clear record of what happened and when.
- Contact your incident response provider, legal counsel, and cyber insurer using pre-approved contact methods.
Avoid making unnecessary changes to affected devices. Actions such as shutting down a system or deleting files may destroy information needed to understand what happened. Follow incident response advice when deciding how to handle potentially compromised equipment.
5. Plan who communicates, and how
During an incident, email and collaboration tools may not be trustworthy or available. Choose an alternate communication channel in advance, and identify one person authorized to issue external updates.
Prepare simple message templates for employees, customers, vendors, and other relevant contacts. They should explain what people need to know and what action to take, without guessing at facts or promising a recovery time you have not confirmed.
For employees, your instructions may include:
- Do not reconnect affected devices or delete suspicious files.
- Use the designated alternate channel for updates.
- Send customer questions to the approved contact or response team.
- Do not speak publicly on behalf of the organization unless authorized.
For customers and partners, share verified information, any relevant service impact, and where to find reliable updates. Keep a record of communications and decisions. Your legal and privacy advisors can help assess whether notification obligations apply and determine the appropriate next steps.
If ransomware is suspected, consider reporting it to the appropriate law enforcement agency. The FBI provides information on ransomware response and accepting reports through the Internet Crime Complaint Center (IC3). Reporting is separate from any legal, contractual, or insurance notification requirements, so consult qualified advisors about those obligations.
6. Restore in a controlled order
Do not assume that restoring files means the incident is over. Work from your service priorities and dependency map. A recovery sequence might begin with secure administrative access and essential network services, followed by critical applications and databases, then employee devices and lower-priority systems.
Before restoring:
- Confirm that the chosen backup is available and appropriate for recovery.
- Check that systems and backup copies are safe to use.
- Address the suspected cause of the incident and secure affected accounts.
- Restore in a controlled environment where possible, then verify the system with its owner before reconnecting it to regular operations.
Track actual restoration time and the age of the data restored. That information shows whether you met your RTO and RPO, and where the plan needs improvement. Include manual workarounds for important services that may not return immediately.
7. Test the plan, not just the backups
A successful backup report does not prove that your business can recover. Schedule both discussion-based exercises and practical restore tests. A tabletop exercise lets staff walk through decisions and communication steps; a technical test checks whether selected files, applications, or systems can actually be restored.
During testing, check whether your team can:
- Find the current plan and reach the right people.
- Access backups, recovery credentials, and vendor support.
- Restore representative systems and validate the data.
- Meet the RTO and RPO targets you selected.
- Communicate through an alternate channel if normal systems are down.
Record what worked, what was delayed, and who will address each gap. Revisit the plan when you change important systems, vendors, staffing, or business priorities. The NIST Cybersecurity Framework 2.0 Small Business Quick-Start Guide offers additional guidance for building cybersecurity practices that fit a smaller organization.
Make recovery a routine part of preparedness
A ransomware recovery plan is most useful when it is realistic, understood, and supported by tested backups. You do not need to solve every technical detail alone: your IT team, legal advisors, insurer, and service providers can help define roles and recovery priorities before an incident occurs.
Comm Tech, MSP Inc. supports Colorado organizations with Business Continuity & Disaster Recovery and managed IT services. If you would like help reviewing your backup strategy or building a practical recovery plan, contact our team.