Ransomware response plan for SMBs: step by step

Ransomware encrypts an organization's files and systems and demands payment to release them. The #StopRansomware Guide from CISA, the US cybersecurity agency, warns that attackers also steal data and threaten to publish it, and that many variants look for accessible backups and delete or encrypt them.

For a small business, the problem is not only technical. In the first hours someone has to decide who disconnects what, who gets called, what to tell customers and staff, and whether there is a duty to report. If those decisions are made for the first time in the middle of the incident, they are made too late.

This article is the plan: before, during and after, with owners and a checklist you can print. It is based on the CISA, MS-ISAC, FBI and NSA guide (September 2023), NIST SP 800-61 Rev. 3 (April 2025), guidance from the UK NCSC and Chile's Law 21.663.

Roles

NIST SP 800-61 Rev. 3 organizes incident response around the six functions of NIST CSF 2.0: govern, identify and protect, which prepare; detect, respond and recover, which are the response. What matters is that every role has an owner, a backup and a phone number written down.

Before: preparation

1. Inventory and critical systems. List devices, cloud services, data and accounts; mark the ones critical to operate or invoice and their dependencies. CISA asks for this so restoration priorities are set before an incident, with a paper copy kept offline.
2. Backups the attacker cannot reach. CISA recommends offline, encrypted backups. The NCSC adds: several copies across different solutions and locations, backup devices that do not stay connected to the network, and cloud services that prevent previous versions from being deleted immediately. Immutable storage helps, but CISA warns that misconfiguration can be costly.
3. Restore test. CISA asks you to regularly test backup availability and integrity in a disaster recovery scenario. Restore a full system and time it: a backup that has never been restored is an assumption.
4. MFA on remote access and privileged accounts. CISA recommends phishing-resistant MFA for all services, especially email, VPN and accounts with access to critical systems. Include the backup console: the NCSC says the second factor should not be on the same device used to administer it.
5. Remote desktop closed. The NCSC notes that ransomware is increasingly deployed through exposed services such as RDP or unpatched remote access devices. CISA recommends closing unused RDP ports.
6. Segmentation. Split the network by area so one intrusion cannot reach everything. CISA recommends segmenting, keeping a network diagram and limiting internal SMB traffic to the systems that need it.
7. Plan and contacts on paper. Write down the phone numbers of your IT provider, backup provider, insurer if you have a policy, lawyer and Chile's National CSIRT (1510). CISA recommends a hard copy and an offline copy: if the file server is encrypted, you will not be able to open the plan there.
8. Tabletop exercise. Get the roles together and walk through a case: early on a Monday, the shared files show up encrypted. The NCSC offers Exercise in a Box for free, with ransomware scenarios. As the NCSC suggests, also agree on how you would respond to a ransom demand and to the threat of data being published.

During: detection and containment

CISA's response checklist, adapted for a small business:

1. Isolate, do not power off. Disconnect affected devices: unplug the cable, turn off Wi-Fi. If several are hit, take the network offline at the switch level. Power off only if there is no other way to disconnect: according to CISA, powering down prevents you from keeping evidence stored in memory.
2. Coordinate out of band. Use the phone or another channel that does not depend on the compromised network. CISA warns that attackers may be watching and could deploy ransomware more widely if they realize they have been discovered.
3. Preserve evidence. Before reinstalling anything: disk image and memory capture from a sample of affected devices, Windows Security logs, firewall logs and the ransom note. In the cloud, volume snapshots.
4. Cut off the attacker's access. Identify the accounts and systems used to get in, including email, and disable compromised accounts. CISA suggests disabling VPNs, remote access servers, single sign-on and other public-facing assets. Organization-wide password resets come once the environment is clean and rebuilt.
5. Protect the backups. Check they are still disconnected and do not connect them to devices you do not know to be clean, as the NCSC advises.
6. Keep a log. Times, facts and decisions; the investigation, the insurer and any report will ask for it.
7. Look for a decryptor. CISA recommends asking law enforcement about available decryptors. No More Ransom, an initiative of the Dutch police and Europol with security companies, collects tools that decrypt some variants without paying.

After: eradication and recovery

1. Find out how they got in and what they left. For CISA, ransomware can reveal an earlier compromise. Look for persistence: rogue accounts, backdoors on perimeter systems, remote administration tools.
2. Rebuild rather than clean. Reinstall from standard images and restore from offline backups on a clean network, for example a new VLAN that only clean systems join (CISA).
3. Check the backup before using it. The NCSC recommends scanning backups before restoring, because ransomware may have been on the network for some time and replicated into them.
4. Restore in order. CISA prioritizes systems critical to health and safety or revenue, together with the systems they depend on, and leaves unaffected systems for last. A possible order:

1. New credentials. With the environment rebuilt, reset passwords for all affected systems and accounts and update the encryption keys you manage (CISA).
2. Formal close. The designated technical lead declares the incident over based on criteria defined in advance (CISA).
3. Lessons learned. Update the plan. NIST SP 800-61 Rev. 3 recommends sharing lessons as soon as they are identified, not after recovery ends.

Communication and obligations in Chile

One voice inside and outside: CISA recommends regular updates to management and coordinating with communications on what is said. This section summarizes legal texts; it is not legal advice.

Law 21.663, Chile's Cybersecurity Framework Law. It applies to providers of essential services and to operators of vital importance designated by ANCI, the national cybersecurity agency (arts. 4 and 5). Essential services include, among others, energy, water, telecommunications, digital infrastructure, IT services managed by third parties, transport, banking and payments, and healthcare. If your business provides IT services to others or healthcare, check whether it applies to you.

Article 9 requires reporting to the National CSIRT any incident that may have significant effects, such as those that interrupt an essential service or affect systems holding personal data (art. 27). It has been in force since March 1, 2025 (DFL 1-21.663). Maximum deadlines:

Reports go through csirt.gob.cl/reportar, which requires essential service providers and operators of vital importance to register their cybersecurity delegate on the ANCI Portal. If you do not provide essential services, the page still has a category for reporting, and the CSIRT answers at 1510.

Law 21.719, personal data. It adds to Law 19.628 an article 14 sexies that will require reporting to the Personal Data Protection Agency "por los medios más expeditos posibles y sin dilaciones indebidas" (by the most expeditious means possible and without undue delay) any breach that creates a reasonable risk for data subjects, and notifying data subjects when it involves, among others, sensitive data or data on children under 14. Under its first transitional article, those changes take effect on the first day of the twenty-fourth month after publication (December 13, 2024): December 1, 2026. A government bill (bulletin 18.623-07) seeks to postpone it: the Senate approved it on October 28, 2026 with a new entry-into-force date of October 15, 2027, and as of November 4 it is in its second reading in the Chamber of Deputies. Until it is enacted, the date in force remains December 1, 2026; check its status.

Should you pay the ransom?

In their joint advisories, such as the one on Medusa, the FBI, CISA and the other authoring agencies do not encourage paying: payment does not guarantee files will be recovered, may embolden attackers to target more organizations and funds illicit activities. They ask victims to report the incident whether or not they pay. The NCSC states that law enforcement does not encourage, endorse or condone paying. It is a management decision with legal advice, and it is best discussed in the tabletop exercise, not in the middle of the incident.

Checklist

Sources

• CISA, MS-ISAC, FBI and NSA · #StopRansomware Guide (September 2023).
• CISA · #StopRansomware: Medusa Ransomware, AA25-071A (revised August 18, 2026).
• NIST · SP 800-61 Rev. 3 (April 2025).
• NIST · Cybersecurity Framework 2.0 (February 2024).
• NCSC · Mitigating malware and ransomware attacks.
• NCSC · Exercise in a Box.
• No More Ransom · About the project.
• BCN · Law 21.663.
• BCN · DFL 1-21.663.
• BCN · Law 21.719.
• Chile National CSIRT · Report.
• Chile Senate · Status of bill 18.623-07.
• Chile Senate · Bill 18.623-07 as approved, sent to the Chamber (October 29, 2026).

At Astrum, cybersecurity is our core line of work. If you want to review your incident response plan, let's talk.