How to Build a Ransomware Recovery Plan You've Actually Tested

The short answer to how to build a ransomware recovery plan: write down four things, then prove them. The four are what you restore first, where each restore comes from, who does each step, and how you reach customers when your main systems are dark. The proof is a real restore of your most critical system from backup, timed from start to finish. Most plans stop after the writing. The restore is the step that tells you your true recovery time. Until you run it, the plan is an estimate nobody has checked.

The four parts of the plan

1. What to restore, in priority order. List your systems and rank them by how fast the business needs each one back. You can't restore everything at once, so decide the order now, calmly, instead of arguing about it mid-crisis.
2. Where each restore comes from. For each critical system: the specific backup, how recent it is, and the actual steps to restore it. Include where the credentials and encryption keys live, and make sure that place is not the machine that got locked.
3. Who does what. Named people for the first hour: who declares the incident, who runs restores, who calls the vendor and the insurer, who talks to customers and staff. Name a backup for each. The primary might be on vacation.
4. How you communicate. A short, honest message for customers and your team, and a channel that still works if email and your main systems are down.

Rank systems by how long you can live without them

Not every system deserves the same urgency, and treating them equally wastes recovery time. NIST SP 800-34, the federal contingency-planning guide, names the number you need for each one: the recovery time objective, how long a system can stay in recovery before the business starts to suffer. For payments, that might be hours. For the marketing site, it might be a week.

Sorting by that number puts the business back on its feet fastest. It also forces an admission most owners avoid: which one or two systems are load-bearing. Those are the ones you protect hardest and test first.

The step that makes it real: test the restore

Take your most critical system and restore it from backup into a separate environment. Time it. Write down what breaks. Expect something uncomfortable: a backup missing a database, a restore that took four hours when the plan said one, a dependency nobody backed up, a sequence nobody remembered. Finding that on a quiet Tuesday costs an afternoon. Finding it during an attack costs days.

The Readiness Drill weights this control more heavily than any other, 22 points of 100, and makes it a trigger: in the drill's shipped sample, a system that scores 78 still reads WOULD NOT RECOVER because nobody has run a timed restore. A restore you have done once is one you can repeat under pressure.

The test restore is not the ransomware restore

A clean test proves the backup works. It doesn't fully prove the ransomware recovery works, because that recovery has an extra step in front. CISA's #StopRansomware Guide warns that attackers often leave other malware behind, and that it has to be found "before rebuilding from backups to prevent continuing compromises." Restore too fast and you can restore the attacker along with the data.

That checking takes time no drill can predict, which is why the Readiness Drill's own runbook tells buyers to keep a separate, longer ransomware recovery-time objective. A full test of a large system can also take days and a second environment you may not have. A partial test of the most critical system still beats none. Treat its result as the floor of your recovery time, not the real number.

Update the plan from what the test finds

Every gap the test surfaces becomes a to-do: fix the incomplete backup, record the real recovery time, add the missing dependency, write down the sequence nobody remembered. Then re-test the parts that failed. Re-test again whenever your systems change, because a plan that matched last year's setup can go stale without anyone noticing. The tabletop exercise is how you pressure-test the human side of the same plan.

Pairs well with

The Shadow AI Discovery & Risk-Triage Kit ($69) finds the systems missing from your step-one list: an amnesty inventory of every AI tool in use, one row per tool. The AI Vendor Reliability & Spend-Justification Scorecard ($79) grades the vendors in step three on reliability and value and returns RENEW, RENEGOTIATE or DO NOT RENEW. After a real incident, the AI Incident Postmortem & Readiness Gate ($79) grades the postmortem and won't let it close while a critical action is still open.