Ransomware readiness is the work an organisation completes before an incident so it can contain disruption, make informed recovery decisions and return to trusted operations. For a growing SME, readiness does not require a large internal security team. It requires clear ownership, usable backups, controlled access and a response plan that people can follow under pressure.

This guide focuses on practical decisions a Singapore SME can make before files are encrypted or systems become unavailable.

Start with the services the business cannot operate without

List the systems, data and third-party services that support revenue, customer delivery, finance, payroll and communication. For each one, record the business owner, technical owner, acceptable downtime and the data that must be recovered first.

This creates a recovery order. Without it, teams may restore the easiest system rather than the one the business needs most.

Confirm that backups are separate and recoverable

A backup is useful only if it survives the incident and can be restored. Document what is backed up, how frequently copies are created, where they are stored and who can administer them.

At least one recovery path should be protected from the same credentials and systems used in normal operations. Test a representative restoration instead of relying only on a successful backup notification. Record how long the restore took, what was missing and which dependencies were required.

Reduce the impact of stolen accounts

Review administrator accounts, remote access and service accounts. Use separate privileged accounts for administrative work, require strong multi-factor authentication where supported and remove access that is no longer needed.

A leaver process should disable accounts and recover devices promptly. A regular access review should identify shared accounts, dormant privileges and suppliers who still have access after a project ends.

Keep systems and security tools maintained

Maintain an inventory of supported devices, servers, cloud services and important applications. Assign responsibility for operating system and application updates, endpoint protection, email security and internet-facing services.

Unsupported systems need an explicit treatment plan. That may mean replacement, isolation, restricted access or an accepted business risk with compensating controls.

Prepare a first-hour response plan

The plan should identify one incident coordinator and the people responsible for technical response, management decisions, operations, communications, legal advice, insurance and data-protection assessment where relevant.

Prepare a secure communication route that does not depend on the affected environment. Include current contact details for key vendors and responders. Decide who may isolate systems, engage specialists, communicate with customers and approve major recovery decisions.

Use the first-hour ransomware checklist as an operational companion to this guide.

Preserve the evidence needed for recovery

During an incident, well-intentioned actions can destroy useful evidence. Staff should know not to wipe devices, reinstall systems, delete ransom notes or run unverified decryption tools without direction from the response lead.

Keep simple instructions for recording the time, affected device, visible message, unusual file extension and actions already taken. Agree a secure method for transferring suspicious samples or encrypted files to a specialist.

Separate decryption, restoration and data recovery

These are different recovery routes. Decryption attempts to reverse the attacker's encryption with a valid key or method. Restoration rebuilds data and systems from backups. Data recovery tries to retrieve usable information from damaged or partially available media and systems.

A responsible assessment may recommend one route or a combination. No provider can guarantee decryption before examining the ransomware variant, file condition and available evidence. Read Can ransomware files be decrypted? for the factors that shape that decision.

FreedomX ransomware response is a separate one-time service. Incident response, decryption assessment and data recovery are scoped to the incident. Decryption is charged only after successful decryption.

Run a tabletop exercise

A tabletop exercise walks decision-makers through a realistic scenario without disrupting production. Test who notices the incident, who is called, how systems are isolated, how business priorities are set and what information management needs.

Record unclear ownership, missing contact details, inaccessible documents and decisions that took too long. Update the plan and repeat the exercise after major system or personnel changes.

A practical readiness checklist

  • Critical services and recovery order are documented.
  • Backup restoration has been tested with recorded results.
  • Privileged and remote access is reviewed.
  • Supported systems and security responsibilities are known.
  • A first-hour incident coordinator and response team are named.
  • Contact details and an independent communication route are available.
  • Evidence-preservation instructions are easy to find.
  • Decryption, restoration and data-recovery decisions have clear owners.
  • A tabletop exercise has produced tracked improvements.

What to do next

Choose one critical service and test the full recovery path from detection to a trusted restore. The result will show whether the main gap is technology, documentation, access, vendor coordination or decision ownership.

If you are preparing before an incident, talk to FreedomX about ransomware readiness. If an incident is already active, use the urgent ransomware intake and avoid changing affected systems until the response has been assessed.