Ransomware Readiness: A 10-Point Checklist for SMBs

Ransomware remains one of the most disruptive cyber threats for Australian and New Zealand SMBs. Attackers no longer only encrypt files—they steal data, threaten publication, and target backups so recovery options collapse.

The good news: most successful attacks exploit gaps that are fixable with disciplined basics. Use this checklist as a practical readiness review—not a theoretical framework.

1. Know what ‘critical’ means for your business

List the systems and data without which you cannot operate for more than a few hours: finance, clinical or case systems, email, identity, file shares, and point-of-sale. Recovery priorities should match revenue and safety impact—not which server is easiest to rebuild.

2. Enforce phishing-resistant MFA everywhere it matters

Multi-factor authentication on Microsoft 365, VPN, remote access, and privileged admin accounts is non-negotiable. Prefer authenticator apps or hardware keys over SMS where possible, and block legacy authentication protocols that bypass MFA.

3. Separate admin accounts from daily work

Staff should not browse email or the web with Domain Admin or Global Administrator rights. Privileged access workstations (or at least dedicated admin accounts) dramatically reduce blast radius when a phishing email succeeds.

4. Patch internet-facing systems on a defined cadence

Firewalls, VPN appliances, remote desktop gateways, and email security tools are frequent initial access points. Track vendor advisories and treat critical remote-code-execution patches as emergency changes—not ‘next maintenance window’ items.

5. Backups are only useful if they restore

• Keep at least one immutable or offline copy that ransomware cannot delete
• Test restores quarterly for a sample of critical systems—not just backup job success alerts
• Document who can declare a disaster and how long a full restore actually takes
• Store recovery runbooks where they remain available if primary systems are offline

6. Segment networks so one compromise is not everything

Flat networks let ransomware move from a single workstation to file servers and domain controllers in minutes. Separate guest Wi‑Fi, OT/IoT devices, and servers; restrict lateral movement with firewalls and least-privilege access.

7. Endpoint detection that someone actually watches

Traditional antivirus is not enough against modern ransomware. EDR/XDR with 24/7 monitoring—and a clear escalation path—turns ‘we had an alert’ into ‘we contained it before encryption’.

8. Email and web filtering with attachment controls

Block high-risk file types, strip macros from Office documents where business allows, and train staff with realistic phishing simulations. Combine technology with culture: reporting a suspicious email should be easy and praised.

9. Incident response plan on one page

Before an attack, decide: who to call (MSP, insurer, legal, cyber incident response), when to disconnect from the network, how to communicate with staff and customers, and who speaks to regulators if personal information is involved.

10. Cyber insurance and evidence readiness

Insurers increasingly require MFA, EDR, and tested backups. Keep evidence of controls—configuration exports, restore test logs, and patch reports—so a claim is not delayed by paperwork when you need cashflow most.

CyberByte helps ANZ businesses harden Microsoft 365, backups, and endpoint defence as part of managed cybersecurity. Contact us for a free, no-obligation readiness review tailored to your environment.