# Build a ransomware recovery plan that proves your backups can work Published by Britixo | 2026-10-29 | Security & Microsoft 365 Canonical page: https://britixo.com/business-guides/ransomware-backup-recovery-plan/ A ransomware recovery plan must show how the business can restore trusted services when ordinary systems or administrator accounts cannot be relied on. Identify critical workflows, protect the recovery capability from the same failure, and rehearse restoration into a controlled environment. A successful backup notification is only one input. Recovery also depends on credentials, application configuration, clean infrastructure, data consistency and people who know when they are authorised to act. ## When this guide is useful Operations leaders and IT teams responsible for keeping critical business services recoverable - Backup jobs report success, but nobody has restored a complete business workflow. - The same administrator account controls production systems and recovery copies. - Recovery instructions are stored only inside the system they are meant to restore. - The organisation knows storage retention but has no agreed recovery time or data-loss tolerance. ## Start with the business workflow you must restore Choose a critical process such as taking orders, paying staff or operating the support desk. Identify the application, database, identity service, network access, integrations and working documents needed for that process. Restoring a database is not sufficient if staff cannot authenticate or the application still points at an unavailable service. Agree what a usable recovery looks like. It might initially be a limited service with a controlled manual queue, rather than every feature returning at once. Name the person who accepts that temporary arrangement and the point at which it becomes unsafe or unsustainable. Record how transactions performed manually will later be reconciled. ## Protect recovery from the production failure NCSC ransomware guidance recommends recoverable backups kept separate from ordinary systems, with regular restore testing and attention to cloud version protection. Review the actual deletion, retention and administrator controls of your chosen arrangement. A synchronised folder can reproduce unwanted changes and should not automatically be treated as an independent recovery strategy. Map who can alter recovery policies, erase copies or reset the accounts protecting them. Apply the agreed separation of duties and stronger administration controls, and verify any immutability or isolation claim in the product's documented scope. Confirm dependencies such as encryption keys and catalogue metadata; inaccessible keys can make an otherwise intact copy unusable. ## Rehearse a clean restoration and measure the whole process Run an authorised exercise in an isolated environment appropriate to the system. Record how the recovery point was selected, how its trustworthiness was assessed and what checks were performed before application use. Use representative business transactions and reconciliation totals, not only a successful server boot, to decide whether the restored service works. Measure elapsed time from the decision to recover through to business acceptance. Include access to recovery media, infrastructure provisioning, database checks, integration reconfiguration and user validation. Keep the exercise proportionate and protect any personal data used in it. Where specialist forensic or malware assessment is required, arrange that capability before an incident. ## Connect technical recovery with incident decisions During an actual incident, the authorised incident lead should coordinate containment, evidence preservation and recovery. Do not reconnect restored systems to an environment whose trust is unresolved. Government ransomware guidance also emphasises business workarounds and impact assessment, including possible data exposure; restoring availability does not itself settle those questions. Maintain a concise offline-accessible contact and decision record through an approved method. Identify who authorises recovery, communicates with customers and evaluates insurance, legal or regulatory requirements. After each exercise, turn the slowest or least certain step into a specific improvement task and repeat that part of the test. ## Prepare for a useful conversation - A dependency map for each priority business workflow. - Agreed recovery-time and recovery-point objectives, with a business owner. - Evidence of recovery-copy protection and access-control separation. - A restore exercise record including reconciliation and business acceptance. - Incident contacts, recovery authorisation rules and a communication route. ## How Britixo can help Britixo can help turn a collection of backup products into a scoped recovery design with clear operating responsibilities. Work can include dependency discovery, recovery objectives, configuration review, restore exercises and handover instructions for the applications you rely on. We can coordinate with your existing infrastructure, security and business teams and document the limits of the agreed solution. Contact Britixo with your critical systems, current recovery arrangement and the disruption you can tolerate. Backup creation, retention, test environments, support availability and incident-response responsibilities are explicitly agreed before implementation. [Contact Britixo](https://britixo.com/contact/?enquiry_type=contact_consultation#contact-form) ## Common questions ### Is a successful backup job enough evidence? No. It does not prove that the required data, credentials and application dependencies can be restored into a usable service within the business objective. ### Can replication replace backups? Replication can help availability, but it may also propagate corruption or malicious changes. Assess independent recovery points and deletion protection against the failure scenarios you need to survive. ### Does recovery prove that no information was stolen? No. Availability recovery and an investigation into possible data exposure are separate workstreams. The incident lead should coordinate both and obtain appropriate specialist advice. ## Related guides - [RTO and RPO explained: set recovery targets your business can test](https://britixo.com/business-guides/disaster-recovery-rto-rpo/) - [Create a security logging plan that produces useful alerts](https://britixo.com/business-guides/security-logging-monitoring-plan/) - [Suspected Microsoft 365 account compromise: a business response plan](https://britixo.com/business-guides/microsoft-365-account-compromise-response/) ## Sources and further reading - [NCSC: Mitigating malware and ransomware attacks](https://www.ncsc.gov.uk/sites/default/files/2026-03/Mitigating-malware-and-ransomware-attacks.pdf) - [UK Government: Guidance during ransomware incidents](https://www.gov.uk/government/publications/cri-guidance-for-organisations-during-ransomware-incidents/cri-guidance-for-organisations-during-ransomware-incidents) Prepared with AI assistance and checked against linked primary documentation. [Editorial approach](https://britixo.com/business-guides/#editorial-approach). Product availability and delivery scope are confirmed for your requirements.