A practical ransomware response plan for UK SMEs that need to contain damage, preserve evidence, restore safely and reduce future risk.
A ransomware response plan helps UK SMEs contain an attack, preserve evidence, restore safely and strengthen defences. The first few hours are critical: isolate affected systems, gather evidence, check backups, communicate carefully and use the incident to improve security for the future.
Disconnect infected laptops, servers and virtual machines from the network. Disable suspicious VPN sessions, remote desktop access and compromised accounts. Do not shut down every machine automatically unless advised, because volatile evidence may be useful. The aim is to stop spread while preserving enough information to understand what happened.
Collect logs from endpoints, firewalls, VPNs, email platforms, Microsoft 365, Google Workspace and servers. Look for phishing emails, exposed remote access, brute force login attempts, suspicious PowerShell, new administrator accounts, disabled antivirus, unusual file access and large outbound transfers. This matters because restoring from backup without closing the entry point can lead to reinfection.
Backups should be checked for integrity and age before recovery begins. If attackers had access for days or weeks, some backups may already contain malware, stolen credentials or backdoors. A clean restore plan should prioritise critical operations, identity systems, customer data, finance systems and website availability.
Keep a clear incident log of decisions, timelines and actions. Inform leadership, IT providers, insurers and legal advisers as needed. If personal data may have been accessed, UK GDPR obligations may apply. Avoid making public statements until the facts are understood. For customer-facing websites, use a simple status update rather than technical speculation.
Ransomware recovery should end with better resilience: multi-factor authentication, least privilege, endpoint detection, patching, email filtering, tested offline backups, password resets, security awareness training and an incident response plan. CyberXperts.ai supports UK organisations with endpoint detection and response, security awareness training and emergency recovery support when ransomware disrupts business operations.
Isolate affected systems to stop the spread and preserve evidence.
Collect and review logs to find the entry point and understand the scope.
Check backup integrity and prioritise critical systems.
Use the incident to strengthen controls and reduce future risk.
A simple checklist to help guide your response and recovery.
Isolate affected systems, such as infected laptops, servers and virtual machines, and disable suspicious accounts and remote access. The goal is to stop the spread while preserving evidence.
Check backup integrity and age before restoration. If attackers had access for days or weeks, some backups may contain malware or backdoors. Prioritise critical systems, including identity, customer data, finance systems and website availability.
Keep a clear incident log and inform leadership, IT providers, insurers and legal advisers as needed. If personal data may have been accessed, UK GDPR obligations may apply. For customer-facing websites, use a simple status update and avoid technical speculation until the facts are understood.