Backups and Ransomware Resilience

Treat backups as a control

Ransomware and accidents both destroy access to files. Regular backups restore availability without negotiating with criminals. Never rely on a single copy sitting only on the same computer.

Follow a simple 3-2-1 idea

• Keep at least three copies of important data
• Store them on at least two different kinds of media or services
• Keep at least one copy offline or off-site (external drive unplugged, or a separate cloud account)

Test restores

A backup you have never opened is unverified. Periodically restore a few files to confirm the process works and that you remember where recovery codes and account logins live.

Respond if files are locked

Disconnect the affected device from the network, preserve evidence if required by work policy, and restore from a clean backup after scanning or rebuilding the system. Do not open unfamiliar decryptor tools from untrusted sites.