Ransomware and AI-Outage Recovery: How to Actually Be Ready

A ransomware recovery plan is ready when you can answer three questions before anything breaks: what you would restore from, who does what, and how long it would take. Most small businesses can answer the first one loosely and the other two not at all. They have a backup nobody has restored, a plan that lives in one person's head, and a recovery time nobody has measured. Readiness comes from proving the recovery works, and the only proof is a test. This guide covers two ways a business stops: ransomware that locks or wipes your data, and an outage of the AI and SaaS tools your work now runs through.

Two failure modes, one readiness problem

The first failure is the familiar one: ransomware or data loss. Files get locked, encrypted or wiped, by an attacker or by a plain hardware failure. The second is newer: a critical tool outage. Your CRM, your payment processor or the AI model your support desk runs on stops answering, and half the operation stops with it, though nothing was hacked.

From the inside they feel the same. They don't share a fix. You can restore your own data. You can't restore someone else's service: when the AI provider is down, no backup brings it back, and what you need instead is a fallback, such as a second provider, a manual process or an agreed pause. Some tools have no good fallback at all, and for those the honest plan is knowing how long you can wait. The Readiness Drill treats the two as separate triggers for that reason. A system that has never had a timed restore, or a load-bearing AI dependency with no fallback, reads WOULD NOT RECOVER whatever its other marks.

The rest of this guide covers building a plan you've tested, backups that survive an attack, an AI outage playbook, and running a tabletop exercise.

The three questions readiness answers

1. What do we restore from? A specific, tested backup, not "it's in the cloud somewhere." You know where it is, how recent it is, and that a restore works because you've done one.
2. Who does what? Named roles for the first hour: who declares the incident, who calls the vendor or insurer, who talks to customers, who runs the restore. Each role has a backup person, because the primary might be on a plane.
3. How long does it take? NIST SP 800-34, the federal guide to contingency planning, calls this the recovery time objective: how long a system can sit in recovery before the business starts to suffer. The useful version is a number measured in a drill, so you can tell customers and staff the truth instead of a hopeful guess.

What readiness is, and what it isn't

Overpromising here is its own risk, so the edges matter. A readiness drill makes you faster and calmer when something goes wrong. It does not make you un-hackable, and it is not a security certification, a compliance attestation or cyber insurance. It is also not prevention. Stopping attacks is a separate job with separate tools.

The Readiness Drill is honest about its own edge too. It scores the recovery posture you describe and never connects to your systems, so a mark you enter as "tested" is only as true as the test behind it. The drill names the gaps. Closing them is still a rehearsal you run yourself.

A word on the legal side

Recovery planning is operational: backups, roles, restore steps. A real incident can also raise legal questions, and those are a different kind of question. CISA's guide tells organizations to make sure their breach-notification procedures follow applicable state laws, and it points to the National Conference of State Legislatures, which reports that all 50 states, the District of Columbia, Guam, Puerto Rico and the Virgin Islands have laws requiring businesses to notify people of security breaches involving personally identifiable information.

Whether any of that reaches your incident depends on where you operate and where your customers are, what data was touched, and what your contracts and insurance policy say. This is general information, not legal advice. Line up counsel and your cyber insurer before an incident, so the first time you read the policy isn't during the crisis.

Start with the cheapest, highest-value move

If you do one thing after reading this, restore your most important system from your existing backup into a separate environment, and time it. It costs an afternoon. In the Readiness Drill's shipped sample, the Core ERP & file servers system scores 78 out of 100, which sits in the RESILIENT band, and still reads WOULD NOT RECOVER, because nobody has ever run a timed restore. The gate releases the moment that mark moves off zero. From there, work through how to build a ransomware recovery plan one step at a time.

Pairs well with

The AI Incident Postmortem & Readiness Gate ($79) is the after-incident half: it grades a finished postmortem and returns CLEARED TO CLOSE AS DESCRIBED, FINISH ACTIONS or NOT CLOSEABLE, and any critical action still open forces NOT CLOSEABLE. The AI Vendor Reliability & Spend-Justification Scorecard ($79) grades the vendors your recovery leans on, and a business-critical vendor that fails any reliability dimension reads DO NOT RENEW. The Agentic AI Security Bundle ($269) covers prevention for AI agents: four Systems that gate what an agent installs, reads, remembers and can reach.