Many businesses say they have a backup plan. The more important question is: Can you restore operations after a ransomware attack?
Ransomware readiness is not proven by having a backup job that reports “successful.” It is proven when your organization knows what to recover first, how to recover it safely, who is responsible for each decision, and how long the process will take.
For small and midsize businesses across Chicago’s Western Suburbs, this distinction matters. A professional-services firm in Oak Brook may depend on client files, email, billing systems, and document-management software. A healthcare office may need scheduling, patient records, communications, and specialized applications to serve patients. If those systems become unavailable, the impact can extend well beyond an IT ticket.
Backups are necessary but they are not the whole plan.
A backup is a copy of data or systems. A recovery plan is the set of decisions and actions required to return the business to operation.
A useful ransomware-readiness program connects five elements:
- Reliable backups that run consistently and are monitored.
- Protected recovery points that attackers cannot easily alter or delete
- Restore testing that proves data and systems can be recovered.
- Prioritized recovery steps that focus on the most important business functions.
- Documented responsibilities so employees are not improvising during a crisis.
CMIT Solutions of Chicago West’s backup guidance emphasizes recovery planning, backup reporting, continuous monitoring, monthly testing, and a combination of on-premises and cloud options.
A hypothetical Oak Brook example.
Imagine a 30-person professional-services firm in Oak Brook. Its team uses cloud email, a document-management system, accounting software, a line-of-business application, laptops, and a small on-premises server.
On a Monday morning, employees discover that shared files have been encrypted. Several systems display ransom notes. The accounting application will not open, and the firm’s usual administrator account is unavailable.
The firm has backups. But before it can resume work, it must answer several questions:
- Which backup is the last clean recovery point?
- Are the backup credentials still trustworthy?
- Can the firm restore the document-management system?
- Is the accounting database intact?
- Can employees work from temporary devices or alternate systems?
- Who communicates with clients?
- Who coordinates with legal counsel, cyber insurance, and outside responders?
- How will the firm avoid reinfecting restored systems?
The difference between a stressful outage and a controlled recovery is often preparation completed before the incident.
1. Define what “restore operations” means
Do not begin with “restore everything.” Begin by identifying the business functions that must return first.
For a professional-services firm, priorities may include:
- Access to active client matters and working documents
- Email and internal communications
- Timekeeping and billing
- Accounting and payment processing
- Customer or client relationship systems
- File-sharing and collaboration tools
For a healthcare office, priorities may include scheduling, patient communications, clinical or practice-management systems, secure access, and the procedures required to continue service safely while systems are unavailable.
The exact priorities depend on the organization. The important step is to document them before an incident occurs.
2. Establish recovery targets
Two planning concepts help turn general goals into measurable expectations:
- Recovery time objective, or RTO: how quickly a system or business function should be available again.
- Recovery point objective, or RPO: how much recent data the organization can afford to lose, measured in time.
For example, a business might decide that email should be restored within four hours, while an internal archive can wait 24 hours. It might also decide that losing more than one hour of billing data would create an unacceptable problem.
These targets guide backup frequency, storage choices, staffing, vendor arrangements, and budget decisions. They should be realistic and tied to business impact.
3. Test restores not just backup jobs
A backup report can confirm that a copy was created. It may not confirm that the copy is complete, usable, or compatible with the systems needed to open it.
A restore test should answer questions such as:
- Can individual files be restored?
- Can a complete device or server image be recovered?
- Can applications and databases start normally?
- Are permissions preserved correctly?
- Can users access the restored data?
- How long does the process take?
- What steps require vendor assistance?
- What happens if the preferred recovery point is damaged?
Record the test results. Note the recovery time, missing dependencies, permission problems, and manual steps. Then assign owners and deadlines for correcting the gaps.
4. Use clean-room thinking
After ransomware, the original environment may not be trustworthy. Restoring data into compromised systems can allow the infection to return.
“Clean-room thinking” means creating a controlled recovery environment before reconnecting restored systems to normal operations. Depending on the incident, this may involve:
- Isolating affected devices and networks
- Confirming that administrative credentials are safe
- Rebuilding or validating systems before restoring data
- Applying current security updates
- Requiring new passwords or authentication controls
- Scanning restored systems and files
- Restoring only verified recovery points
- Monitoring systems closely after recovery
The specific response should be coordinated with qualified incident-response, legal, insurance, and compliance professionals as appropriate. A blog checklist cannot replace incident-specific advice.
5. Protect backups from attackers
Backups should not be treated as an invisible copy of the production environment. Review who can access them, how administrative accounts are protected, whether versions are retained, and whether storage is separated from everyday user accounts.
Consider the role of:
- Multifactor authentication
- Least-privilege access
- Encryption in transit and at rest
- Version history and retention policies
- Separate administrative credentials
- Offsite or geographically separated storage
- Backup alerts and reporting
- Regular recovery testing
CMIT’s local data-backup page describes encrypted backups, redundant storage in geographically diverse data centers, version history, time stamping, and recovery planning as elements of data resilience.
6. Document who does what
During a ransomware incident, responsibility should not depend on whoever happens to answer the phone first.
Create a responsibility matrix that identifies:
- Incident commander or business decision-maker
- IT or managed-services contact
- Backup and recovery owner
- Cyber insurance contact
- Legal counsel
- Communications lead
- Finance and banking contact
- Key software and connectivity vendors
- Law-enforcement or regulatory contacts, where appropriate
Also document who can authorize system isolation, emergency purchases, client notifications, downtime procedures, and restoration decisions.
Keep the plan accessible when email and shared drives are unavailable. Store a secure offline or separately accessible copy, and review the contact list regularly.
7. Plan for the first 24 hours
A simple first-day checklist can reduce confusion:
- Declare the incident and activate the response team.
- Isolate affected devices and systems.
- Preserve relevant logs and evidence.
- Protect or suspend compromised accounts.
- Contact the managed-services or incident-response provider.
- Notify cyber insurance and legal contacts according to the policy.
- Identify critical business functions and safe recovery points.
- Communicate clear instructions to employees.
- Begin recovery in a controlled environment.
- Record decisions, times, actions, and outstanding risks.
The order may change depending on the incident. The value is having a starting framework instead of creating one under pressure.
8. Run a tabletop exercise
A tabletop exercise is a guided discussion based on a realistic scenario. It does not require taking systems offline.
For example, ask the Oak Brook office scenario participants:
- Who discovers the incident?
- What happens if the usual administrator is unavailable?
- Can employees reach the recovery plan?
- What is restored first?
- Who communicates with clients?
- How do you verify that a backup is clean?
- When do you move from temporary workarounds to full recovery?
Write down unanswered questions. Those gaps become the next improvement tasks.
Ransomware readiness is a business capability
A resilient organization does not assume that prevention will always work. It combines layered cybersecurity with dependable backups, tested restores, clear priorities, clean recovery procedures, and documented responsibilities.
CMIT Solutions of Chicago West helps businesses across the Western Suburbs strengthen managed IT, cybersecurity, backup, disaster recovery, and business continuity practices. Contact the local team to review your backup readiness and determine whether your organization could restore critical operations after a ransomware event.
