Could Your Business Recover from Ransomware? Seven Questions to Ask

Ransomware recovery is not simply an IT task. It is a business-wide test of decision-making, communications, identity security, backups and the ability to operate under pressure.

A plan can look convincing until it meets a real incident. Ask these seven questions now to expose assumptions while there is still time to correct them.

1. Do we know which services must return first?

List the processes that protect safety, revenue, client commitments and regulatory responsibilities. Identify the systems, accounts, suppliers and information each process depends on. Recovery priorities should be agreed by the business, not guessed by technicians during the incident.

2. Are our backups protected from the same attack?

If ordinary administrator accounts can delete or encrypt every backup, the recovery system may fail alongside production. Use separation, restricted credentials, immutability or offline copies appropriate to the risk, and monitor unexpected changes.

3. When did we last prove a complete restore?

Testing a single file is useful but does not prove that servers, applications, permissions and dependencies can be restored in the required order. Run documented recovery exercises and record the real time, skills and decisions involved.

4. Can we operate while systems are unavailable?

Recovery may take longer than expected. Define safe manual procedures, alternative communication channels and the minimum information teams need. Make clear which activities must pause rather than continue insecurely.

5. Who can make urgent decisions?

Assign technical and business incident leads, deputies and authority levels. Record how to reach insurers, legal advisers, forensic specialists, critical suppliers and communications support without relying on compromised email or inaccessible files.

6. How will we investigate without destroying evidence?

Immediately rebuilding every device can remove clues needed to understand entry, spread and data access. Your plan should balance containment and recovery with logging, evidence preservation and specialist investigation.

7. Have we rehearsed the difficult conversations?

Practise how the team would brief employees, clients and leadership, assess reporting obligations and respond to rumours or criminal demands. Templates help, but facts must be verified before external statements are made.

Measure recovery in business terms

Define a recovery time objective for each critical service and the amount of data the business could tolerate losing. Then test whether the current architecture, contracts and people can meet those objectives. A mismatch is a business decision requiring investment, acceptance or a change in expectations.

Astley Digital helps organisations strengthen backup, continuity and incident readiness. Explore our cyber incident recovery service or speak to our team before an incident tests the plan for you.