A ransomware response plan is a short written document that tells everyone in your business who does what, in what order, from the minute someone sees a ransom note. The template below is built for small businesses with 5 to 100 staff, no full-time security team, and customers in the US, UK, Canada or Australia. Copy it into a document, fill in the blanks today, print one copy, and store another one offline. If your files are encrypted right now, jump straight to the first-hour actions.
Most small-business owners discover during an attack that they do not know who to call, where the backups live, or whether they are legally required to tell anyone. A plan written in advance removes those questions at the worst possible moment. This guide is a fill-in template, not a general explainer. If you want the plain-language version of what ransomware is, read What Is Ransomware?. If you are already past the first day, see our first 24 hours checklist.
Important limits of this template
This is general information, not legal advice. Reporting duties differ by country, state, province and industry, and they change. Where this guide mentions a legal duty, treat it as a prompt to confirm with your own lawyer and your cyber insurer, ideally before an incident happens. The sources for every government claim are listed at the end of the article.
What a Good Small-Business Ransomware Plan Contains
The official guidance from governments converges on the same building blocks, even though each agency words them differently. The joint #StopRansomware Guide from CISA, the FBI and partners includes a response checklist. The Canadian Centre for Cyber Security publishes a Ransomware playbook (ITSM.00.099). The UK's National Cyber Security Centre and Australia's Cyber Security Centre both publish ransomware pages with similar steps. Boiled down for a small business, a usable plan has eight parts:
- Roles: one named decision-maker and one named technical lead, each with a backup.
- Contact tree: phone numbers that work when email and Wi-Fi do not.
- First-hour actions: what to do, and what not to touch.
- Evidence preservation: what to keep so insurers, police and forensics can work.
- Notification map: who must or should be told, by country.
- Restore order: which systems come back first, from which clean backup.
- Communication templates: pre-written messages for staff, customers and suppliers.
- Post-incident review: what you change so it does not happen again.
Part 1: Roles and Responsibilities (Fill In)
In a small business, one person often fills several roles. That is fine, as long as each role has a named backup who is reachable when the first person is on a plane or asleep. Write real names, not job titles.
| Role | What they do | Primary (name and mobile) | Backup (name and mobile) |
|---|---|---|---|
| Incident lead (decision-maker) | Makes the calls on shutdown, payment questions, customer notices and spending. | ____________________ | ____________________ |
| Technical lead | Isolates devices, checks backups, coordinates with your IT provider or responders. | ____________________ | ____________________ |
| Scribe | Keeps a timestamped log of every observation, decision and call. | ____________________ | ____________________ |
| Communications | Sends approved messages to staff, customers and suppliers. Nobody else speaks externally. | ____________________ | ____________________ |
| Legal and privacy contact | Advises on notification duties, regulators and privilege. | ____________________ | ____________________ |
| Finance contact | Freezes payment changes, alerts the bank, tracks incident costs for the insurer. | ____________________ | ____________________ |
Rule for the whole team: only the incident lead can authorize shutting down the whole network, contacting the attackers or speaking to media. Write that sentence into the plan so nobody has to argue about it mid-incident.
Part 2: Contact Tree (Fill In and Print)
Assume email, your phone system and possibly your office Wi-Fi are down or watched by the attacker. Store this table on paper in a locked drawer and as a PDF on a phone or USB key that is not part of your network. Use personal mobile numbers, and agree on an out-of-band channel (for example a group chat created on personal phones) that you only use during incidents.
| Who | Name / company | 24/7 phone | Policy or account number |
|---|---|---|---|
| IT provider or managed service provider | ____________________ | ____________________ | ____________ |
| Cyber insurance claims line (many policies require notice before you hire responders) | ____________________ | ____________________ | ____________ |
| Breach counsel / lawyer | ____________________ | ____________________ | n/a |
| Incident response firm (if pre-approved by insurer) | ____________________ | ____________________ | ____________ |
| Bank / merchant processor | ____________________ | ____________________ | ____________ |
| Internet and cloud providers (Microsoft 365, Google, backup vendor) | ____________________ | ____________________ | ____________ |
| Local police non-emergency line | ____________________ | ____________________ | n/a |
| Key customers or partners with data-sharing agreements | ____________________ | ____________________ | ____________ |
The single most useful action you can take this week is to find your cyber insurance policy, read the "what to do after an incident" section, and write the claims phone number in the table above. Many policies expect you to call the insurer first and to use their approved responders. Calling your own favorite firm first can complicate coverage. Our guide to ransomware and cyber insurance coverage explains what is typically covered and what is commonly excluded.
Part 3: The First Hour (Action Checklist)
The goal of the first hour is to stop the spread and preserve evidence, not to fix anything. Print this list and tick it off. The scribe records the time next to each item.
First-hour checklist
- Minute 0 to 5, isolate: Unplug the network cable and turn off Wi-Fi on every affected computer. If you cannot tell which ones are affected, isolate the segment or switch they share. Time: ______
- Do not power off yet: Leave affected machines running if you can, because memory can hold evidence such as encryption keys or running processes. Power off only if your technical lead or responder tells you to, or if encryption is visibly still spreading and you cannot isolate it. Time: ______
- Do not delete anything: No wiping, reinstalling or "cleaning" yet. Do not run random removal tools downloaded in a panic. Time: ______
- Photograph the ransom note and screens: Use a phone camera. Record file extensions, the note text, any contact address or payment instructions. Time: ______
- Call the incident lead and technical lead: Use the contact tree, not email. Time: ______
- Call your cyber insurer: Report the claim and ask what they require before spending money. Time: ______
- Disconnect backups: Unplug external drives and NAS devices that are not yet encrypted, and pause cloud sync clients so encrypted files do not overwrite good copies. Time: ______
- Reset credentials from a clean device: Using a phone or a computer you know is clean, change the passwords and revoke sessions for email, banking, cloud and admin accounts. Start with the administrator and finance accounts. Time: ______
- Alert staff by phone or text: Tell them not to open files, not to plug in USB drives and not to log in to anything until told. Time: ______
- Start the incident log: The scribe records who saw what, when and what was done. Time: ______
Why not shut everything down immediately? Government ransomware checklists generally put isolating affected systems and preserving evidence ahead of cleanup. Powering a machine off can lose volatile data that responders use to understand how the attacker got in. That said, if you have no technical help on the phone and the damage is visibly spreading, isolating by cable and switch is almost always safer than leaving it running. When in doubt, call your IT provider before pulling any power.
Part 4: Isolate and Preserve Evidence
Evidence matters for three reasons: your insurer will ask for it, police and national cyber agencies can use it, and a forensic responder needs it to find out how the attacker got in. If you skip that last step and simply restore from backup, the same door may still be open.
| Keep | Where to find it | Who collects it |
|---|---|---|
| Ransom note, screenshots, photos of screens | Affected desktops, shared folders, phone camera | Scribe |
| Encrypted sample files and a few clean originals for comparison | Any affected share | Technical lead |
| Firewall, VPN and remote-access logs | Router or firewall admin page, VPN appliance | Technical lead or IT provider |
| Microsoft 365 or Google sign-in and audit logs | Admin portal (export before retention windows expire) | Technical lead |
| Antivirus or EDR alerts | Security console | Technical lead |
| Suspicious emails and attachments | Mailbox (forward as attachment to a safe address, do not open) | Technical lead |
| Disk images or memory captures of key machines | Taken by a forensic responder, not by staff | Responder |
| Incident log with timestamps | Paper or an offline document | Scribe |
Do not forward the ransom note or logs to personal email accounts, and do not store evidence on the compromised network. Use an encrypted USB drive or a separate cloud folder created from a clean device. If you suspect your email was compromised, assume attackers can read anything you send through it.
Part 5: Timeline, First Day and First Week
Once the first hour is done, the work shifts from stopping the spread to understanding scope and planning recovery. Use this timeline as a default and adjust with your responder.
| When | Goal | Actions | Owner |
|---|---|---|---|
| Hour 1 | Contain | Isolate, photograph, call lead, insurer and IT provider, reset critical credentials, start log. | Incident lead |
| Hours 2 to 4 | Scope | List affected devices, servers, accounts and data. Check if backups are intact and offline. Engage insurer-approved responder. Brief counsel. | Technical lead |
| Hours 4 to 24 | Preserve and decide | Capture logs and images. Decide whether personal data may have been accessed or copied (double extortion). Report to police and the national cyber agency for your country. Send first staff update. | Incident lead |
| Day 2 to 3 | Eradicate | Responder identifies entry point and persistence. Rebuild or clean affected systems. Rotate all passwords, keys and tokens. Close the entry point (for example exposed remote desktop, stolen VPN login, unpatched appliance). | Technical lead and responder |
| Day 3 to 7 | Restore | Restore in priority order (Part 7) from clean backups. Monitor for re-infection. Complete regulator and customer notices where required. | Technical lead, communications |
| Week 2 to 4 | Learn | Run the post-incident review (Part 9). Update the plan, backups, access controls and training. Close out the insurance claim. | Incident lead |
These time windows are planning defaults, not promises. Real recoveries vary widely with the size of the business, the quality of backups and how far the attacker got. If your backups are sound and offline, recovery of core systems can be quick. If they are encrypted too, expect a much longer road, which is why backups come up repeatedly in this guide. See our guides on automated backups for small business and a simplified business continuity plan.
Part 6: Who to Notify, Country by Country
Reporting to government agencies helps investigators connect cases and may open access to guidance, decryptors or intelligence. Separately, privacy and sector laws may require you to notify regulators and affected people if personal data was accessed or taken. Those are two different tracks. Use the table for the agency track, then ask your lawyer about the legal track.
| Country | Report the crime and incident | Privacy or breach regulator (if personal data is involved) |
|---|---|---|
| United States | FBI Internet Crime Complaint Center (ic3.gov), and CISA at cisa.gov/report. Your local FBI field office is another route. | No single federal breach law covers every business. All 50 states have breach notification laws, and sector rules such as HIPAA apply to health data. Ask counsel which laws apply in the states where your customers live. |
| United Kingdom | NCSC incident reporting at report.ncsc.gov.uk, and Report Fraud, the national fraud and cyber crime reporting service that replaced Action Fraud. | Information Commissioner's Office (ICO). Under UK GDPR, a reportable personal data breach must be reported without undue delay and, where feasible, within 72 hours of becoming aware of it. |
| Canada | Local police, the Canadian Anti-Fraud Centre (CAFC), and the Canadian Centre for Cyber Security through its My Cyber Portal. The Cyber Centre ransomware playbook names these three routes. | Federal PIPEDA: report to the Office of the Privacy Commissioner when a breach creates a real risk of significant harm. Quebec: see the Law 25 note below. Alberta and British Columbia have their own private-sector privacy acts. |
| Australia | ReportCyber at cyber.gov.au. The Australian Cyber Security Centre hotline is 1300 CYBER1 (1300 292 371), open 24/7. | Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme, for organizations covered by the Privacy Act, where an eligible data breach is likely to cause serious harm. Also see the ransom payment reporting rule below. |
Quebec: Law 25 and the CAI
Businesses in Quebec that hold personal information are subject to the Act respecting the protection of personal information in the private sector, as amended by Law 25. In general terms, when a "confidentiality incident" presents a risk of serious injury to the people concerned, the business must act promptly to notify the Commission d'accès à l'information (CAI) and the affected individuals, and it must record every confidentiality incident in a register. Whether your ransomware event meets that threshold depends on what data was exposed and how sensitive it is. Give the facts to your lawyer, let them make the call, and keep notes on how you assessed the risk even when you conclude that notice is not required. Please confirm the current requirements with counsel. Our guide to the privacy incident register under Law 25 explains what to log.
Australia: reporting a ransom payment
Under Australia's Cyber Security Act 2024, certain businesses must report a ransomware or cyber extortion payment to the government within 72 hours of making the payment or becoming aware that one was made on their behalf. The rule applies to businesses carrying on business in Australia with annual turnover above the threshold (AUD 3 million in the previous financial year, per the government's published guidance) and to some critical infrastructure entities. It commenced on 30 May 2025. Reporting is done through a form on cyber.gov.au. If you are in Australia and payment is under discussion, ask counsel to confirm whether you are covered before any money moves.
Part 7: Restore Order (Fill In Before You Need It)
When systems come back, they should come back in the order that restarts revenue and protects people first, not in the order that is easiest. Fill in this table now, while you are calm. Restore only from backups you have verified are clean, onto systems you have verified are clean, with the entry point closed.
| Priority | System or data | Backup location and date | Max acceptable downtime | Owner |
|---|---|---|---|---|
| 1 | Identity: Microsoft 365 or Google admin, domain controller, password manager | __________ | ______ hrs | __________ |
| 2 | Email and phones | __________ | ______ hrs | __________ |
| 3 | Accounting, payroll, invoicing, payment terminals | __________ | ______ hrs | __________ |
| 4 | Line-of-business application (booking, CRM, ERP, practice software) | __________ | ______ hrs | __________ |
| 5 | Shared files and client documents | __________ | ______ hrs | __________ |
| 6 | Staff laptops and workstations (rebuild, do not clean in place) | __________ | ______ hrs | __________ |
| 7 | Everything else | __________ | ______ hrs | __________ |
Before you restore anything
- The responder or technical lead has identified and closed the entry point.
- All administrator, service and user passwords have been reset, and multi-factor authentication is enforced. See our MFA guide for business owners.
- The backup you plan to use pre-dates the first sign of compromise, and has been scanned in an isolated environment.
- Restored systems are placed on a separate network segment first and monitored for unusual activity.
- Endpoint detection is running. If you still rely on basic antivirus, compare it with EDR for small business.
Part 8: Paying the Ransom, What Authorities Say
Write your company's position into the plan before an attack, because the pressure to pay is highest when systems are down and the clock on the ransom note is ticking. Here is what the official sources say.
- Canada: The Cyber Centre's ransomware playbook says the decision to pay is up to the organization, but that paying does not guarantee access to your data, that threat actors may still demand more money, leak or sell your data, or attack you again, and that paying may be unlawful under laws against terrorism, money laundering, funding criminal organization activities, or sanctions legislation. It advises contacting local police before you even consider paying.
- United Kingdom: The NCSC states that it and UK law enforcement do not encourage, endorse nor condone the payment of ransom demands, and warns there is no guarantee you will get access to your data, your computer will still be infected, you will be paying criminal groups, and you are more likely to be targeted in future.
- Australia: The Australian Cyber Security Centre says to never pay a ransom, because paying does not guarantee you regain access to your data, or that criminals will not sell or leak your information, and it can make you a target for further attacks. If a payment is made, the reporting rule above may apply.
- United States: CISA and the FBI do not encourage paying ransoms, noting that payment does not guarantee recovery and may embolden criminals or fund other illicit activity. The US Treasury's Office of Foreign Assets Control (OFAC) has published an advisory, first issued in 2020 and updated in 2021, warning that facilitating ransomware payments to sanctioned persons or regions can carry sanctions liability. Ask counsel to screen any payment question against current guidance.
Plan rule to adopt
"No payment discussion, negotiation or contact with the attackers happens without the incident lead, our lawyer and our insurer all being on the call." Many cyber policies have specific conditions around ransom payments, and a payment made without them can jeopardize coverage. Write down who the three people are, and do not let anyone open the attacker's chat portal on their own.
The practical lesson is the same in every country: the cheapest way to win the "pay or not" debate is to have tested, offline, immutable backups so that the question never becomes urgent.
Part 9: Communication Templates (Copy and Fill In)
Get these approved by your lawyer now and keep them in the same offline folder as your contact tree. Keep them factual. Do not speculate about cause, do not blame individuals and do not promise outcomes you cannot control.
Template A: Staff notice (send by phone, text or personal email)
Subject: Urgent IT incident, please read
Team, at ______ (time) on ______ (date) we detected a security incident affecting our systems. Until you hear from ______ (incident lead), please: do not open or save files on company computers; do not connect USB drives; do not log in to company systems; do not forward this message outside the company. If you see a ransom note or anything unusual, take a photo with your phone and call ______ (technical lead, phone). We will update you by ______ (time). Please direct all questions from customers, suppliers or media to ______ (communications contact) and do not reply to them yourself.
Template B: Customer and supplier holding statement
Subject: Service disruption at ______ (business name)
We are experiencing a technical disruption affecting ______ (services). We are working with ______ (IT provider or specialists) to restore service and have notified the appropriate authorities. We are still determining whether any personal information has been affected. If that is the case, we will contact you directly with what happened, what information was involved and what you can do. In the meantime, if you receive a message that appears to come from us asking for payment or password details, please verify it by calling ______ (phone) first. Next update: ______ (time/date).
Template C: Notice to affected individuals (only after counsel review)
Regulators in different countries expect specific content, usually including what happened, when, what information was involved, what you are doing about it, what the person can do to protect themselves, and who to contact. The structure below is a starting point only. Your lawyer will adapt it to the law that applies.
What happened: ______
When: ______ (dates of incident and discovery)
What information was involved: ______
What we are doing: ______
What you can do: ______ (for example change passwords, watch statements, place a fraud alert with credit bureaus where available)
Contact: ______ (name, phone, email)
Your rights: ______ (regulator contact, as advised by counsel)
Part 10: Post-Incident Review (Fill In Within Two Weeks)
After recovery, hold one meeting with the incident team, the scribe's log and your IT provider. The goal is to find what to change, not who to blame. Use these questions as the agenda.
| Question | Our answer | Action and owner | Due date |
|---|---|---|---|
| How did the attacker get in (phishing, exposed remote access, stolen credentials, unpatched system)? | __________ | __________ | ______ |
| How long between first compromise and detection? | __________ | __________ | ______ |
| Which backups worked, and which failed? How long did restore actually take? | __________ | __________ | ______ |
| Did everyone know their role and who to call? | __________ | __________ | ______ |
| Which notifications did we make, and were they on time? | __________ | __________ | ______ |
| What did the incident cost (downtime, responders, legal, lost sales)? | __________ | __________ | ______ |
| What will we change in access control, MFA, patching and training? | __________ | __________ | ______ |
Prevention items the review should feed into
- Backups: keep at least one copy offline or immutable, and test a restore on a schedule. Write down the date of the last successful test: ______.
- Multi-factor authentication: enforce it on email, remote access, VPN and admin accounts.
- Patching: remove internet-exposed remote desktop where possible, and patch VPNs, firewalls and servers promptly.
- Least privilege: staff should not use admin accounts for daily work.
- Training: phishing remains a common way in. See our guides to phishing and spear phishing.
- Tabletop exercise: once a year, spend 60 minutes walking through this plan with a pretend scenario and fix the blanks you could not fill.
How a Specialist Can Help, and What It Costs
You do not need an outside party to fill in this template, but a second pair of eyes is useful for two things: testing that the backups can actually be restored, and checking that the remote access and admin accounts attackers favor are locked down. IT Cares offers a single remote Expert Consultation at CA$119.99 (plus applicable tax) for 60 minutes, where a technician can review your backup setup, walk through this plan with you and list the gaps. It is a consultation, not a guarantee of protection, and it is not legal advice. If you are in the middle of an incident, call 1 (888) 711-9428 and say so. For active recovery work, see our ransomware recovery service and ransomware removal information.
Frequently Asked Questions
Sources
- CISA, #StopRansomware Guide (joint with FBI, NSA and MS-ISAC, updated May 2023)
- CISA, Report a cyber issue and FBI Internet Crime Complaint Center (IC3)
- US Treasury OFAC, Advisory on potential sanctions risks for facilitating ransomware payments
- Canadian Centre for Cyber Security, Ransomware playbook (ITSM.00.099)
- UK NCSC, What you need to know about ransomware and Report Fraud
- Australian Cyber Security Centre, Learn about ransomware and ransomware payment reporting
- Commission d'accès à l'information du Québec (confirm Law 25 duties with counsel)
Government guidance and legal duties change. Check each agency's current page and confirm legal obligations with a qualified lawyer. This article is general information, not legal advice, and does not guarantee any outcome.