A ransomware response plan is a short, tested document that tells your business who decides what, which systems to isolate first, who to call and when to report. If you write it before an attack, you spend the first hour following steps. If you don’t, you spend it arguing about them. This guide covers what a UK small or medium-sized business needs in that plan, the legal clocks that start running, and how to keep the document from becoming shelf-ware.
Why a ransomware response plan is a business decision, not an IT task
The NCSC’s guidance on mitigating malware and ransomware frames ransomware as something that disrupts the whole organisation. Your plan therefore has to cover decisions that sit outside the IT team: whether to take public-facing systems offline, how to talk to staff and customers, and how to communicate when email and phones are unavailable.
The most common failure is not a missing tool. It is unclear authority. The NCSC’s board guidance on planning your response to cyber incidents makes the case for agreeing, in advance, who can shut systems down or approve a recovery route. Under stress, people make worse decisions, so the plan should make the important ones before the incident.
IASME describes an incident response plan as a set of principles covering the who, why, what, where and when of your reaction, coordinating people, process and technology. That is a useful test for your own draft: if a section does not answer one of those questions, it probably does not belong.
What your ransomware response plan should contain
Keep it short enough to read under pressure. Six elements cover most small businesses.
- Decision-makers and deputies. Name one person with authority to isolate systems and one deputy. Add trigger points for involving senior management or directors.
- Critical systems and data. Following the NCSC’s small business guidance on preparing for incidents, list the information your business cannot run without, and where it is stored.
- Offline contact sheet. Phone numbers for your IT provider, insurer, legal adviser, bank and key suppliers, held on paper or on a device that does not depend on your network. The NCSC advises keeping these offline and easy to reach.
- Alternative communications. How staff will be told what to do if email and Teams are encrypted or switched off.
- Backup and recovery order. Which systems come back first, from which backups, and who confirms they are clean.
- Reporting and record-keeping. Who assesses personal data impact, who reports, and where decisions are logged.
The first hour: ransomware response steps
These steps suit a typical SME. Adjust them to your environment and keep your IT provider’s instructions on top if they differ.
- Isolate, do not wipe. Disconnect affected devices from the network and Wi-Fi. Do not reformat them; you may need evidence of what happened and how.
- Raise the alarm through your offline contact sheet. Call your IT support provider and your cyber insurer. Many policies include a helpline and legal support, and some have conditions about who you may instruct.
- Identify what is affected. Which devices, accounts, servers and cloud services? Which backups are untouched?
- Contain account access. Reset credentials and review privileged accounts once you know the affected scope, working from a clean device.
- Start a log. Record times, actions, who decided what and why. You will need it for insurers, regulators and your own review.
- Slow down before any decision on payment. Attackers use pressure to force quick choices. UK government guidance for organisations during ransomware incidents advises taking time to review every option, and a rehearsed plan makes that possible.
On payment specifically, the same guidance warns that paying may be unlawful in some circumstances, such as when funds go to a sanctioned entity. Take legal advice before engaging with a demand, often available through your insurer. It also stresses reporting to law enforcement promptly, which helps authorities build evidence and disrupt criminal operations.
The legal clock: ICO reporting within 72 hours
This is the part many plans leave out. Encrypted files are not only an operational problem. The ICO’s ransomware and data protection guidance makes clear that losing access to personal data can itself be a personal data breach, even if nothing was copied out.
Your plan should therefore include a documented risk assessment, whether or not you end up reporting. If the breach is notifiable, the ICO’s personal data breach guide says you must report without undue delay and within 72 hours of becoming aware of it. You can supply further information in phases if the full investigation takes longer, provided you explain the delay.
Logging matters here. Without adequate logs, you may be unable to show the ICO whether data was taken, which makes your risk assessment harder to defend. If you are working out how recovery planning fits that deadline, our article on disaster recovery planning against the ICO 72-hour clock goes into more detail.
Recovery: rebuilding in the right order
Recovery is where preparation shows. A practical order for most SMEs:
- Confirm the way in is closed. Restoring into a still-compromised environment invites a second incident.
- Restore the critical services first, using the list you made in advance, then wider systems.
- Check backups before you rely on them. Offline or immutable copies matter because attackers often target connected backups. Our backup and disaster recovery service is built around this problem.
- Review Microsoft 365. Cloud email and files are not automatically safe from loss. We cover the gaps in our guide to Microsoft 365 backup.
- Reset passwords and tighten access using a clear policy; our SME password policy is aligned with NCSC, Cyber Essentials and ICO guidance.
- Hold a review. What let the attack in, what slowed you down, and what changes in the plan?
The NCSC recommends a defence-in-depth approach, since no single control stops all malware. Recovery should feed back into those layers: patching, endpoint monitoring, backups and staff awareness.
Test the plan before you need it
The typical pitfall is a plan written once and never opened again. IASME and the NCSC promote Exercise in a Box, a free-to-use online tool with more than 15 exercise topics including ransomware, offering micro, tabletop and simulation formats. A tabletop session of an hour or two is enough to expose a missing phone number or an unclear sign-off.
Review the plan at least annually, and whenever your systems, suppliers or key staff change. If you want ideas on structuring rehearsals and escalation decisions, this incident response playbook is a useful read on practising response decisions under pressure.
How we help with ransomware readiness in Aberdeen
At Abersecure, we build security into IT support from the outset, with 24/7 endpoint monitoring, patch management and specialist escalation, and we offer incident response, a cyber risk assessment and security awareness training. If you want help drafting and testing a ransomware response plan for your Aberdeen or Aberdeenshire business, see our managed cyber security service, or look at our Advanced package. Before the plan, a cyber risk assessment shows where your biggest gaps are.
FAQ
What is the best response to a ransomware attack?
Isolate affected devices, contact your IT provider and insurer, and record every action. Take time to review your options rather than reacting to the attacker’s deadline. Take legal advice before any decision on payment.
Do I have to report ransomware to the ICO?
If personal data is affected, you must assess the risk, and a notifiable breach must be reported within 72 hours of becoming aware of it. Loss of access, such as encrypted files, can count as a personal data breach. Document your assessment either way.
Should we pay the ransom?
Take legal advice first. UK government guidance warns that payment may be unlawful in some circumstances, for example where the recipient is sanctioned, and paying does not guarantee you get your data back.
How often should we test our ransomware response plan?
At least once a year, and after major changes to your systems or staff. A short tabletop exercise is enough to find unclear authority or missing contacts.
