FTC Safeguards Rule
Covered financial businesses must keep a written incident response plan covering roles, communications, remediation and review.
Managed IT services
Ransomware protection and recovery for your business
Separate backups, Defender on every device, a written plan, and an engineer on site when needed, for businesses from Charleston to Savannah.
Clear recovery plans
Several services working together as one plan
Ransomware protection here draws on several services working together. Review what is in place before an attack, what happens step by step during one, and how your work comes back.
- 1
Separate system backups
Each backup is kept separate from the machine it protects, because a copy on the same server or in a synced folder is encrypted along with the original.
- 2
Devices and alerts watched
Microsoft Defender monitors devices, and alerts become tracked tickets. Suspicious machines are cut off from the network while they are dealt with.
- 3
Written recovery order
Recovery follows a written order of critical systems, with an engineer on site 24/7 when needed to lead the response.
Critical systems plans for every business
Every business depends on different systems. A critical systems list sets an order of return, so your most important operations come back first.
Choose your industry
Order of return
Example order. Names and order are an example, not a promise of times.
Step by step ransomware recovery in action
Each step is shown with the tool or person involved. Screens shown here are Microsoft's and Veeam's own documentation screenshots with sample data to illustrate the process.
Images credit Microsoft Learn and Veeam Help Center.
Essential defenses in place before an attack
Separate services operate in the background to back up whole machines, monitor devices for alerts, apply scheduled patches and control system sign-ins.
Software
See also
Written incident response plan and standards
Cybersecurity guidelines from CISA advise creating, maintaining and exercising a basic cyber incident response plan and communications plan, keeping a contact list with roles clearly defined for owners and managers.
Incident response planExample
- Decision maker
- Primary contact authorized to approve system isolation and restoration steps.
- Call list, 24 hours
- Contact list showing who to call 24 hours a day and their specific roles.
- Calling when email offline
- CISA recommends phone calls rather than email to communicate, because attackers may be watching network traffic.
- Order of return
- Predefined critical asset list determining which systems come back online first.
- Notification procedures
- Communications plan detailing external notifications and internal updates for staff.
- Review after
- Documented review where lessons learned from the incident update the plan and procedures.
Regulatory requirements for written plans
HIPAA
Medical practices are required to have a data backup plan, a disaster recovery plan and an emergency mode operation plan, and to test and revise them.
CISA
Cybersecurity agencies advise creating, maintaining and exercising a basic cyber incident response plan and communications plan with response and notification procedures for ransomware incidents.
Common questions about ransomware protection
- What does ransomware protection include?
Protection draws on separate services working together: separate backups, Microsoft Defender for Business on devices, scheduled patching, security awareness training, alert monitoring, and emergency on-site IT support.
- Is a backup in the same office or synced to the cloud enough?
Copies sitting on the same server or synced to cloud folders get encrypted along with originals. Backups must be kept separate from the machines they protect.
- What is an incident response plan and what does it hold?
Written plans map out exactly how your business handles an event, detailing decision makers, 24-hour call lists, critical systems return orders, communication methods and post-incident reviews.
- What does ransomware recovery look like step by step?
Suspicious alerts become tickets, affected devices are isolated, an engineer arrives on site to take charge, systems restore from separate backups in a written order, and patches close gaps.
- What incident response services does CloudCentric provide?
Services include alert monitoring, ticket tracking, isolating affected devices, dispatching an engineer on site 24/7 to fix outages, and delivering a plain-terms incident report afterward.
- How does a business start this process?
Getting started means the order of what comes back first is decided with the business. A walkthrough can be booked or the phone called at (844) 422-7000 to begin. Prices and timelines are not stated here.
- Where does your service area cover?
Engineers cover businesses across the coast, including Charleston, Mount Pleasant, North Charleston, Isle of Palms, Folly Beach, Kiawah, Beaufort, Bluffton, Hilton Head and Savannah.
Ransomware protection starts with a walkthrough
Call (844) 422-7000 or book a walkthrough to review your critical systems and begin building your incident response plan.
CharlestonMount PleasantNorth CharlestonIsle of PalmsFolly BeachKiawahBeaufortBlufftonHilton HeadSavannah