The Ransomware Readiness Checklist Every San Diego Business Needs

Ransomware is an operations problem, not just an IT problem

When ransomware lands, the damage is rarely the encryption itself — it is the days of downtime, the lost invoices, the customers who cannot reach you, and the compliance reporting that follows. Treating it purely as a technical event is how small businesses end up paying.

The organisations that recover fastest are the ones that decided, in advance, what they would do in the first hour. That decision is what this checklist encodes.

The 30-day hardening checklist

We run this with every new managed client. None of it requires enterprise budget — it requires that someone owns it.

• Enforce MFA on email, VPN, and every admin account — no exceptions for executives.
• Remove local administrator rights from standard user workstations.
• Deploy managed EDR with 24/7 monitoring, not just consumer antivirus.
• Keep immutable, offsite backups and test a real restore quarterly.
• Patch operating systems and third-party apps on a defined weekly cadence.
• Segment the network so a single compromised laptop cannot reach servers.
• Run phishing simulations and short, frequent security awareness training.

Test the restore, not the backup

A backup that has never been restored is a hypothesis. We routinely find backup jobs reporting success while silently skipping the one database that actually matters.

Schedule a live restore drill at least every quarter, time it, and document the result. Your recovery time objective should be a measured number, not an aspiration.

Write the first hour down

Your incident response plan should fit on one page: who declares an incident, who isolates affected machines, who contacts your insurer and legal counsel, and how staff and customers are told. Print it. If your network is encrypted, the copy on your file server will not help you.