Updated October 9, 2026
It is Monday morning, and a shop’s files will not open. A note on the screen says the data is encrypted. For some owners, this is a bad day. For others, it is a lost month. The difference is usually the backup, and whether it was out of the attacker’s reach and ever tested.
This guide follows three invented small businesses through the same disaster. The common thread comes from CISA’s #StopRansomware Guide, which advises keeping offline, encrypted backups of critical data and regularly testing them in a disaster recovery scenario.
Why “offline” matters
CISA’s guide explains why the word “offline” is there. Many ransomware variants try to find backups they can reach, then delete or encrypt them so recovery is impossible unless the ransom is paid. A copy that stays connected to the same network and login as your computers may be exposed to the same attack.
Two planning ideas help you size a backup plan. They are standard in disaster planning, though the labels below are this article’s own plain-English versions:
- How much work can we afford to lose? Disaster-planning guides call this the recovery point objective. It sets how often you back up.
- How long can we be down? This is the recovery time objective. It decides how much you must be able to restore, and from where.
Shop 1: A four-person bakery
The bakery keeps sales records, supplier invoices, a payroll spreadsheet and recipes, about 120 GB in total. The owner can recreate a day’s paperwork but not a month’s.
The plan: A nightly automatic backup to an encrypted cloud service that keeps older versions, plus a weekly copy to an encrypted external drive that is unplugged afterward and kept off the premises.
What could be lost: If the 1:00 a.m. cloud backup is clean and recoverable, a failure at 4:30 p.m. leaves 15.5 hours of work exposed. If it is also compromised, the weekly disconnected drive may be the latest usable copy, exposing up to a week of work.
Restore math: 120 GB over a 200 Mbps connection is 120,000 MB ÷ 25 MB/s = 4,800 seconds, or about 80 minutes at best. This is transfer time only, not a promise that the bakery can reopen in 80 minutes. System rebuilding, checks and application setup add time.
Shop 2: A freelance video editor
The editor holds about 6 TB of footage and finished projects. Finished work is irreplaceable. Raw footage may be re-sent by clients.
The plan: Back up finished projects first and often, keep dated, versioned copies of active projects on two rotating external drives, and keep one drive disconnected and stored away from the desk.
Restore math: 6 TB over a 500 Mbps connection is 6,000,000 MB ÷ 62.5 MB/s = 96,000 seconds, about 26.7 hours. From a local drive that sustains 100 MB/s, the same restore takes 60,000 seconds, about 16.7 hours. The ideal transfer alone takes about 17 to 27 hours; a complete recovery can take longer, so the editor needs a priority list: current client work first.
Shop 3: A two-person bookkeeping practice
The practice stores about 300 GB of client financial records. Confidentiality matters as much as availability.
The plan: Encrypted backups every four working hours during busy season, a separate offline encrypted copy, and the encryption passphrase stored somewhere other than the computers being protected.
What could be lost: With successful backups every four working hours, up to 4 working hours of new work is at risk if the latest clean backup survives. Failed jobs or an older usable copy can increase that loss.
Restore math: 300 GB over 100 Mbps is 300,000 MB ÷ 12.5 MB/s = 24,000 seconds, about 6.7 hours. They decide that a client folder restore must work in under an hour, so they practice with one client at a time.
The three plans side by side
| Shop | Data size | Backup rhythm | Offline copy? | Best-case cloud data transfer |
|---|---|---|---|---|
| Bakery | 120 GB | Nightly, plus weekly drive | Weekly drive, kept off-site | About 80 minutes |
| Video editor | 6 TB | Finished work often; mirrored drives | One drive disconnected | About 26.7 hours |
| Bookkeepers | 300 GB | Every four working hours in busy season | Separate encrypted copy | About 6.7 hours |
The 30-minute restore drill
CISA also advises regularly testing the availability and integrity of backups, so try this small version of a recovery.
- Pick one real folder, never the live system.
- Restore it to a different location.
- Open several files and confirm they are current and readable.
- Note how long it took and anything you had to look up, such as a forgotten passphrase.
- Write the result and the date where the team can find it, and fix what failed.
The schedule is the owner’s choice. One reasonable rhythm is a single-folder test every month and a larger restore a few times a year, scaled to how much a loss would hurt.
Four mistakes all three shops avoided
- Treating a synced folder as a backup. Sync tools may copy a deletion or encrypted file onto every device. Ask whether yours keeps older versions and how far back.
- Keeping the backup logged in. If the same stolen login can reach your backups, they may not survive.
- Never testing. A backup you have not restored is an assumption.
- No written plan. CISA’s guide recommends keeping a hard copy and an offline version of your response plan available.
For basic ransomware tips, CISA’s ransomware page repeats the same core advice: offline, encrypted, tested.