“We’re fine, we have backups.” It’s the most common answer South African SME owners give when asked how they’d survive a ransomware attack. It’s also the answer attackers are now counting on.

Ransomware in 2026 rarely goes straight for your live data. It goes for your backups first, locating them, disabling them, encrypting or deleting them so that when the encryption finally hits, you have nothing to fall back on and every reason to pay. Your backup strategy was almost certainly built to recover from a failed drive or a deleted folder, not from an attacker who is actively hunting your recovery options. The businesses recovering fastest today have stopped treating backup as protection and started treating it as a target.

The Step-by-Step Checklist

1. Stop Assuming Backups Are Safe

One of the biggest changes in ransomware over the past two years is that attackers increasingly target backup systems before launching encryption attacks.

According to ITWeb’s 2026 analysis of the South African SME threat landscape, ransomware groups are no longer focused solely on encrypting production environments. They are increasingly targeting backup systems first to eliminate recovery options before the attack begins.

This means that “we have backups” is no longer the question.

The real question is:

Would your backups still be available after a ransomware attack?

2. Review Your Backup Architecture

Many SMEs operate with one of the following backup setups:

• An external hard drive
• A NAS device on the same network
• A cloud backup platform
• A local backup server

The challenge is that if attackers gain administrator access, they often gain access to backup systems too.

Review whether your backup environment is:

• Separated from production systems
• Protected by MFA
• Restricted to authorised administrators
• Monitored for suspicious activity

If not, your backups may be vulnerable to the same attack affecting your primary systems.

3. Implement Immutable Backups

Immutable backups cannot be modified, deleted, or encrypted during a defined retention period.

This has become one of the most important ransomware recovery controls available.

Research published by Enterprise Strategy Group in 2025 found that 96% of organisations that experienced ransomware attacks reported that attackers specifically targeted backup data. The same research found that immutable backup storage is widely regarded as one of the most effective ransomware recovery controls.

For SMEs using Veeam, Microsoft Azure, or other modern backup platforms, immutability is increasingly becoming a standard requirement rather than an advanced feature.

For many SMEs, this starts with implementing professionally managed backup solutions that include monitoring, offsite replication, recovery testing, and ransomware protection. ASG’s backup solutions are designed to help businesses recover quickly while reducing the risk of backup failure during a cyber incident

4. Move Beyond the 3-2-1 Backup Rule

Most businesses are familiar with the traditional 3-2-1 rule:

• Three copies of your data
• Stored on two different media types
• One copy stored offsite

That remains a strong foundation.

However, many recovery specialists now recommend the 3-2-1-1-0 approach:

• Three copies of data
• Two different storage types
• One offsite copy
• One immutable or air-gapped copy
• Zero recovery testing errors

This additional layer helps ensure at least one copy remains protected even if attackers gain administrative access.

5. Test Recovery Regularly

Many businesses know backups are running.

Far fewer know whether recovery will actually work.

According to ITWeb’s reporting on ransomware resilience in 2026, many organisations have backup systems in place but rarely test recovery capabilities. When an incident occurs, they discover recovery objectives cannot be achieved within the required timeframe.

At minimum, businesses should regularly test:

• File restoration
• Microsoft 365 recovery
• Server recovery
• Recovery time objectives
• Recovery point objectives

A backup that has never been tested is an assumption, not a recovery strategy.

6. Include Recovery in Business Continuity Planning

Ransomware is no longer purely an IT issue.

It affects:

• Operations
• Finance
• Customer service
• Compliance
• Reputation

Recovery planning should answer:

• Who makes decisions during an incident?
• How long can operations be offline?
• Which systems are most critical?
• What must be restored first?

Without clear recovery priorities, businesses often lose valuable time during an incident.

7. Prepare for Identity-Based Attacks

Many modern ransomware groups compromise Microsoft 365 accounts, VPN accounts, or administrator credentials before attacking systems.

Once attackers gain privileged access, they often disable or manipulate backup environments.

This means ransomware recovery planning must also include:

• Multi-factor authentication
• Privileged access controls
• Password management
• Identity monitoring

Recovery starts long before a backup is restored.