The real test is not whether backups exist, but whether the business can restore trusted operations.
Ransomware remains one of the most disruptive cyber threats facing organisations. It can encrypt systems, interrupt operations, expose sensitive information and place management under pressure to make urgent decisions. The business impact can extend far beyond IT, affecting finance, procurement, service delivery, customer confidence and regulatory obligations.
Many organisations assume that having backups means they are protected. Unfortunately, ransomware incidents often reveal that backups were incomplete, not isolated, not regularly tested or not aligned to business recovery expectations. In some cases, backups are also encrypted or deleted by attackers before the organisation realises that an incident has occurred.
Why this matters
Ransomware readiness is about resilience. Management should know which systems are critical, how quickly they need to be restored, who can authorise recovery decisions and whether the organisation can recover without relying on the attacker. This requires preparation before an incident, not only technical action during a crisis.
What management should consider
- Identify the systems and data that are essential to continued operations.
- Confirm whether backups are offline, immutable or otherwise protected from ransomware.
- Test actual restores, rather than relying only on successful backup logs.
- Review privileged access, as attackers often use administrator accounts to spread ransomware.
- Maintain an incident response contact list that includes IT, executives, legal, communications and insurers.
- Practise decision-making through a ransomware tabletop exercise.
- Validate recovered systems before reconnecting them to the production environment.
Common pitfalls to avoid
Assuming backup jobs prove recoverability.; Restoring systems before confirming the attacker no longer has access.; Leaving crisis decisions to the technical team alone..
Key takeaway
A backup is only valuable if it can be restored within the required timeframe and trusted after recovery. Ransomware resilience must be tested before a real incident occurs.
Practical first step
Select one critical system and perform a practical restore test. Record the time taken, the issues encountered and whether the restored data can be trusted.
How Nexia SAB&T can assist
Nexia SAB&T can assist with ransomware readiness reviews, backup and recovery assessments, incident response tabletop exercises and cyber resilience maturity reviews.
Author details: Rob Galetti | IT Audit and Cybersecurity | Nexia SAB&T
Date: 15 July 2026
