If ransomware locked your files on Monday morning, who would decide what happens next? If the answer is not written down, it is worth writing now, because during an attack nobody has time to think.
This guide gives you a ten-step recovery plan to write before an attack, a table of who owns what, and a short worksheet for setting recovery times. It is general guidance, not legal advice, and parts of it should be reviewed by your lawyer and insurer.
Why a Written Ransomware Recovery Plan Matters for Mid-Size Firms
Ransomware is common, and smaller firms feel it most. Verizon's 2026 Data Breach Investigations Report, covering incidents from November 2024 to October 2025, found ransomware in 48% of breaches, up from 44% a year earlier (Verizon, 2026). In the 2025 edition, ransomware was present in 88% of breaches at small and medium organizations (under 1,000 employees) against 39% at large ones (Verizon, 2025), and the 2026 edition says that among ransomware cases where the victim's size was known, about 96% of victims were in that small and medium group. The FBI's 2025 Internet Crime Report logged 3,611 ransomware complaints, up from 3,156 in 2024 (FBI IC3, 2026); the FBI notes that its loss figures leave out lost business, time and recovery services.
The ransom is only part of the bill. Sophos surveyed 2,158 IT and security leaders at firms of 100 to 5,000 employees in 17 countries in early 2026. It found that the average (mean) cost to recover, excluding any ransom, was $1.7 million, with a median of $375,000, and 55% of firms recovered within a week (Sophos, 2026, vendor data). Sophos also reports that 66% of victims whose data was encrypted restored from backups, up from 54% a year earlier. A one-week recovery is possible, but the survey does not say what separates the firms that manage it.
Steps 1 to 4: Decisions, Backups, Isolation and Contacts
Name who decides. Pick one incident lead (often the COO or head of IT) and a named deputy. Give them authority to take systems offline without waiting for a meeting. Add a second person for business decisions such as paying staff or telling customers.
Keep offline backups and test the restore. CISA's guidance is to maintain offline, encrypted backups of critical data and test them regularly (CISA #StopRansomware Guide), because attackers go after backups: in a 2024 Sophos survey of 2,974 ransomware victims, 94% said the attackers tried to compromise their backups (Sophos, 2024, vendor data). The UK's NCSC offline-backup guidance puts it as a question: "At any given time, are one or more backups offline?" Until you have restored from a backup, you do not know it works. Our suggestion: restore one real system each quarter and time how long it takes.
Know how to isolate. CISA says to immediately isolate affected systems and, if many are involved, shut the whole network down at the switch. It also advises coordinating by phone rather than email, so attackers who may be watching do not learn they were detected. Write down who can pull network cables, disable remote access and suspend accounts, and where those instructions are kept offline.
Print the contact list. Phone numbers for your incident lead, IT provider, cyber insurer's claims line, lawyer, bank, and a forensic firm. Keep a paper copy as well. The NCSC advises keeping the contact details of key personnel readily available for use in an incident.
Know who you must notify. Depending on your industry, location and the data involved, you may have to tell regulators, customers or partners within set deadlines. CISA recommends reporting to CISA, your local FBI field office or the FBI's IC3. Ask your lawyer now which deadlines apply to you, and write them in the plan. Check your cyber insurance policy now: some policies set notice deadlines or name the responders you must use.
Plan the communications. Decide who speaks to staff, customers and the press, and keep one holding statement ready. Staff need a way to hear from you if email is down, such as a phone tree or a messaging group on personal devices.
Set the restore order. List your systems by how much the business stops without them: usually identity and network first, then finance and customer-facing systems, then the rest. CISA advises restoring from clean backups in order of critical services, so decide the order while you are calm. The worksheet below helps.
State your payment stance. Paying is a business and legal decision, not a technical one. The data suggests fewer firms are doing it: Coveware reported that payment rates dropped to a record low of 23% in Q3 2025 (Coveware, 2025, vendor data), and its July 2026 report says the share of clients who pay fell to a new record low in Q2 2026 (Coveware, 2026), while 63% of organizations in IBM's 2025 study of 600 breached firms chose not to pay (IBM, 2025). Sophos, on the other hand, found that 48% of the firms whose data was encrypted paid, so numbers vary by sample. Decide in advance who may authorize talks, ask your lawyer about sanctions rules and your insurer about coverage, and ask law enforcement whether a decryptor exists.
Preserve evidence. CISA suggests capturing disk images and memory from a sample of the affected devices, and says to power devices down only if you cannot disconnect them from the network, because shutting down can destroy volatile evidence. Do not wipe machines before your forensic team or insurer says you can. Keep a timestamped log of every action and decision.
Review afterward. Our suggestion: within two weeks, hold a blameless review: how did they get in, what slowed you down, what did the plan get wrong. Fix the top three items and update the plan. The NCSC advises updating your response plans after every incident.
Who Owns What Before, During and After an Attack
Roles matter more than titles. In a small firm one person may hold several, which is fine as long as each has a named backup. The split below is our suggestion, not a standard.
Role | Before | During | After |
|---|---|---|---|
Incident lead | Owns the plan; runs a yearly tabletop exercise | Makes containment and restore calls | Chairs the review; tracks fixes |
IT or provider | Runs backups; tests restores each quarter | Isolates systems; restores in order | Closes the entry point; hardens access |
Owner or CEO | Approves budget and payment stance | Approves spending and customer messages | Reports to board, insurer and clients |
Legal and insurer | Confirm notification duties and cover | Advise on notices, evidence and payment questions | Handle claims and regulator follow-up |
Communications | Drafts holding statements; keeps phone tree | Updates staff and customers on a schedule | Sends the closing summary |
A Recovery-Time Worksheet for Your Top Systems
A recovery time objective (RTO) is how long the business can run without a system before the damage becomes serious. Fill this in for your five most important systems, with the business owner of each and not only IT:
System name and owner: for example, billing, with the finance lead named.
Cost of one day down: lost sales, idle staff, late-payment penalties. A rough number is enough.
Target restore time (RTO): hours or days you can tolerate.
Tested restore time: what your last restore drill actually took. If it is longer than the target, you have found your gap.
Backup location and last test date: and whether one copy is offline.
Dependencies: what must be running first, such as login, network or database.
Manual workaround: how the team works while it is down, such as paper order forms.
If the targets you wrote are shorter than the times you tested, that gap tells you where to spend: faster restore tooling, an extra offline copy, or simplifying a system that is hard to rebuild. In our view, older unsupported systems tend to be the hardest to rebuild, which is one reason to watch for signs your legacy system needs modernization and to look at how to modernize legacy software without a full rewrite.
Close the Common Doors Before You Need the Plan
A plan helps after the fact. Prevention lowers how often you need it. In Sophos's 2026 survey the top technical root causes were malicious email (26%) and phishing (24%), followed by compromised credentials (23%) and exploited vulnerabilities (18%, down from 32% a year earlier). Sophos says 79% of attacks started with an identity-based approach, and that 97% of victims whose attack began with compromised credentials had multi-factor sign-in enabled in some form, which suggests it was not applied everywhere. Keep software patched, remove accounts nobody uses, apply multi-factor sign-in to remote access and email, and make it easy for staff to report a suspicious message.
Access matters more as automation spreads. If you let AI tools or agents act inside your systems, limit what they can touch, as covered in how to control what AI agents can access. If an outside team builds your software, ask how it reviews and secures code, which our guide on checking the code you pay for walks through. IBM's 2025 study puts the average cost of an incident involving extortion or ransomware, when disclosed by the attacker, at $5.08 million (IBM, 2025), though that is a global average across firms of all sizes.
Conclusion: Write the Plan This Month
You cannot stop every attack, but you can decide, in advance and in writing, who acts, what gets restored first and who you call. Start with steps 1, 2 and 4, then book a restore drill. The rest follows from those.
This article is general guidance, not legal advice. Check notification duties, sanctions and insurance terms with your own lawyer and insurer.
If you would like a second pair of eyes on your backups, system priorities or recovery times, our software consultancy team can map your critical systems with you and help make them quicker to rebuild. Book a call and we will go through it together.
