Ransomware: what small businesses should do before it happens

Ransomware is malicious software that locks your files and demands payment to unlock them. Small businesses are often targeted because attackers expect weaker defences and a strong need to get back to work quickly.

The good news is that a few simple steps taken in advance can turn a disaster into an inconvenience.

How it usually gets in

Most ransomware doesn't need clever hacking. Common routes include:

• A phishing email with a malicious attachment or link

• A weak or reused password on a remote access service

• Software that hasn't been updated, leaving a known hole open

Five steps to take now

Cyber Essentials is a self-assessment questionnaire that is checked by a certification body. Cyber Essentials Plus covers the same controls but adds a hands-on technical check of your systems by an independent assessor.

Do you need it?

You may need it if:

• You want to bid for UK government contracts that handle sensitive or personal information
• Larger customers ask suppliers to hold it
• You'd like an independent way to show customers you take security seriously

Even if nobody has asked, working through the five controls is a useful way to find and fix gaps.

Getting ready

Most of the effort is in preparation: knowing what devices and accounts you have, and fixing anything that doesn't meet the requirements before you apply. Check the current requirements and costs with an official certification body, because the details are updated from time to time.

If you'd like help getting ready, see our Cyber Essentials Preparation service, or get in touch. The free Cyber Health Check is a good first step. It is an indicative self-assessment, not a certification.