If ransomware is suspected, follow your approved incident response plan, isolate affected systems quickly, preserve evidence, contact the right responders, and restore only from clean, tested backups. A checklist helps a small business act calmly, but it must be adapted into the organization’s formally approved incident response and communications plans before an attack.
This sequence follows CISA’s #StopRansomware Guide response guidance (the September 2023 guide version; CISA’s overview page says the guide was updated in May 2023), produced with the FBI, NSA and MS-ISAC. Preparation steps are deliberately separated from actions during an active incident.
As an Amazon Associate I earn from qualifying purchases.
What a small business should do first
Ransomware response has four priorities: contain the intrusion, protect evidence, coordinate decisions and recover safely. Do not improvise from a single employee’s workstation or rely on ordinary email if attackers may be monitoring the network.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →- Use the approved incident response plan (IRP). CISA’s response checklist says: “Should your organization be a victim of ransomware, follow your approved IRP.”
- Identify and isolate affected systems. Disconnect them from the business network as soon as practical, using coordinated instructions.
- Activate the response team and communications plan. Bring in the people who can make network changes, assess legal and customer impact, contact leadership and engage outside help.
- Preserve evidence and logs. Avoid actions that unnecessarily destroy volatile information.
- Recover in priority order from clean, tested backups. Keep compromised systems away from the clean recovery environment until they are handled.
The checklist is a decision aid, not a substitute for professional incident response. The final plan should name people, alternates, authorities, contact methods and approval thresholds for your own business.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Preparation checklist: build the plan before an attack
1. Inventory critical systems and dependencies
Make a current list of the systems that keep the business operating and the dependencies each one needs. Include servers, endpoints, network equipment, identity services, line-of-business applications, payment or order systems, file stores, cloud environments and essential vendors. Record which services depend on a particular database, domain, internet connection or administrator account.
For each item, document an owner, recovery priority and a practical way to identify it during an outage. Keep the documentation securely available, including an offline copy where an encrypted, access-controlled copy is appropriate. A plan that exists only on a file share encrypted by the attacker cannot guide recovery.
2. Write and approve an incident response plan
The IRP should describe how the business detects, contains, investigates, reports and recovers from a cyber incident. Include escalation criteria, decision authority and procedures for preserving evidence. Define who may disconnect a host, isolate a switch or subnet, disable an account, contact an insurer or authorize restoration.
Name a primary and backup person for every role. A small company may assign several roles to one person, but it should still record the separation of responsibilities:
- Incident lead and technical containment owner
- Leadership or business owner who approves major decisions
- IT staff or managed service provider able to make network and identity changes
- Communications lead for employees, customers, suppliers and regulators
- Legal, privacy or compliance adviser
- Insurance or breach-response contact
- Business-continuity owner who prioritizes services and workarounds
Store current phone numbers and secure contact details outside the normal corporate systems. Review the plan after organizational, network or supplier changes.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
3. Add a separate communications plan
Decide in advance how the response team will communicate if email, collaboration tools or phones linked to the affected identity system are unavailable. Establish an out-of-band method, such as direct phone calls or another independently controlled channel. Prewrite short internal notices that tell staff what to stop doing, where to report suspicious activity and who is authorized to speak externally.
Include approval steps for notifying customers, suppliers, law enforcement, insurers and regulators. Do not promise a notification deadline in the plan unless it is tied to the applicable jurisdiction, sector and data involved; those requirements vary with the facts of the incident.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 114. Maintain offline, encrypted backups
CISA recommends: “Maintain offline, encrypted backups of critical data, and regularly test the availability and integrity of backups in a disaster recovery scenario.” Offline means the backup is not continuously reachable through the credentials and network paths an attacker could compromise. Encryption protects the backup if the storage device or media is lost or stolen.
Use a backup architecture that fits the business rather than treating one device as a complete strategy. An encrypted external hard drive can be one physical implementation of offline storage, but it does not by itself provide resilience. Maintain appropriate copies, access controls, retention and geographic separation for your systems and risk profile.
| Recovery approach | Questions to verify before relying on it | Trade-offs to document |
|---|---|---|
| Offline encrypted media | Is it disconnected when not being used? Are keys protected separately? Has a full restore been tested? | Manual handling and slower recovery may be required; loss or damage must be considered. |
| Cloud backup with immutability | Are immutable retention settings enabled? Are administrative accounts separated from production? Can the business restore without the compromised identity system? | Configuration errors, compliance obligations and service dependency can add risk. |
| Multiple cloud environments | Are accounts, credentials and management planes separated? Have cross-environment restores been exercised? | Cost, operational complexity, compliance concerns and vendor lock-in may increase. |
Test that backups are available, intact and usable in a disaster-recovery scenario. A successful backup job is not proof that an application, permissions, encryption key or database can be restored. Maintain system images or other recovery materials where practical, and record the order in which critical services must return.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
5. Exercise the plan
Run a tabletop exercise before an incident. Practice a scenario in which an employee reports encrypted files, the identity system is unavailable and ordinary email may be monitored. Confirm that each person can find the offline plan, reach the next role, authorize isolation and explain the first business priority. Record gaps and update the plan; an untested plan is only an assumption.
Free tools Windows power users keep installed
One-click scans. No signup required.
Active incident checklist
Detect and contain without destroying evidence
When ransomware is suspected, follow the approved IRP and identify which systems show symptoms. Signs can include inaccessible or renamed files, ransom notes, unusual account activity, disabled security tools or simultaneous failures across devices. Treat the report as an incident until qualified responders establish otherwise.
- Record the initial facts. Note the reporter, time, host names, visible message, affected accounts and any recent suspicious event. Do not edit or delete ransom notes or logs.
- Isolate affected systems promptly. If several systems or subnets appear affected, consider network-level isolation at the switch or other appropriate network control. If that is not feasible, disconnect affected devices from Ethernet and Wi-Fi.
- Coordinate the isolation. Use the response team and out-of-band communications where possible. Attackers may monitor organizational activity; uncoordinated changes can alert them or cause avoidable damage.
- Preserve relevant evidence. Retain available endpoint, identity, firewall, cloud and backup logs. Follow the responder’s instructions for collection and chain of custody.
Should you turn off the infected computer?
Not automatically. CISA warns that powering down can remove volatile-memory evidence and treats it as a fallback when temporary network or host disconnection is not possible. First try to disconnect the computer from Ethernet and Wi-Fi, or use an approved network control that prevents communication while leaving the system available for authorized forensic work.
If disconnection cannot be achieved and continued operation creates an immediate risk to other systems, follow the IRP and responder direction on powering down. Record who made the decision, when and why. Do not repeatedly reboot, run cleanup tools or attempt random decryption utilities before evidence and containment decisions are made.
Triage the wider environment
Isolation of one workstation does not prove the incident is limited to that workstation. Review security-product alerts and available logs for additional impacted hosts, accounts, persistence or lateral movement. Check critical dependencies such as identity, file shares, virtualization, remote access and backup administration.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Classify systems by business impact: services needed for safety or legal obligations first, then systems required to process orders, communicate with customers, pay staff or resume normal operations. This triage supports a defensible recovery order without guessing which device is most visible.
Who to call after a ransomware attack
Activate the response and communications plan rather than calling people ad hoc. Notify the incident lead and leadership, then involve the contacts appropriate to the facts:
- Internal IT staff or the managed technology or security provider able to contain and investigate
- Your cyber-insurance or breach-response contact, if coverage exists and the policy requires early notice
- Legal and privacy advisers who can assess evidence handling, contracts and notification duties
- Communications and customer-support leads who can coordinate accurate updates
- Business-continuity owners who can authorize manual workarounds and prioritize restoration
Consider reporting to CISA, the local FBI field office or the FBI Internet Crime Complaint Center, and seek appropriate assistance. If personal or business customer information may have been accessed or exfiltrated, follow the organization’s notification plan and the requirements that apply to the relevant jurisdiction, sector and data. The timing and recipient of notices cannot be determined from the presence of ransomware alone.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to restore the business safely
1. Establish a clean recovery boundary
Do not connect compromised hosts or unverified accounts to the clean recovery environment. Confirm that administrative credentials, remote-access paths and backup consoles are not under attacker control. Have responders assess eradication and rebuild requirements before returning systems to production.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →2. Restore by critical-service priority
Use the inventory and dependency map to restore the most important services first. Select a recovery point that predates the compromise when possible, and verify backup integrity before using it. Restore a controlled system, validate its data and security configuration, then proceed to the next dependency.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Plan for identity and access dependencies: applications may appear restored while users cannot authenticate, service accounts fail or encryption keys are unavailable. Record each restoration decision and test the business function, not merely whether a server starts.
3. Monitor for reinfection
Keep heightened monitoring in place during and after restoration. Review endpoint, identity, network and backup logs for renewed suspicious activity. Reconnect systems in stages, with the response team agreeing that the controls and credentials required for each stage are ready.
4. Document and improve
Maintain a timeline of decisions, actions, affected systems, communications, costs and service impact. After operations stabilize, conduct a lessons-learned review with technical, leadership and business-continuity participants. Update the IRP, communications plan, inventories, backup design and exercises to address what failed or was unclear.
Recommended Free Tools
Practical decision checklist
- Is the suspected host isolated without unnecessarily powering it down?
- Has someone checked whether other systems, subnets, accounts or backup controls are affected?
- Can the response team communicate outside potentially monitored corporate channels?
- Are leadership, technical, legal, insurance and continuity roles active and reachable?
- Have relevant logs, ransom notes and other evidence been preserved?
- Is the proposed recovery source offline or otherwise protected, encrypted and tested?
- Has the team established that restoration will not reconnect a compromised identity or management path?
- Are customer, employee, supplier and official reporting decisions being made under the applicable notification plan?
- Is every major decision recorded with its time, owner and reason?
What this checklist cannot decide for you
No generic checklist can determine whether a particular business must notify a regulator, whether a ransom demand should be paid, which forensic method is appropriate or how long restoration will take. Those decisions depend on jurisdiction, contracts, sector rules, evidence, system architecture and available responders. Put the organization’s approved thresholds and professional contacts into the plan before an incident, then use qualified advisers when the event occurs.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
