Ransomware-Proof Backups: What CISA's Guide Actually Recommends
CISA's #StopRansomware guide is clear that backups only help if attackers can't reach them. Its backup advice, in plain terms, for small organizations.
In this article
Ransomware encrypts files so systems can't be used, and attackers demand payment for the key. CISA's #StopRansomware Guide, written with MS-ISAC, the NSA and the FBI, notes that attackers increasingly also steal data and threaten to publish it, a tactic known as "double extortion." Good backups don't stop data theft, but they decide whether you can recover without paying.
Keep backups offline and encrypted
The guide's first preparation step is to "maintain offline, encrypted backups of critical data." Its reasoning is specific: "many ransomware variants attempt to find and subsequently delete or encrypt accessible backups." A backup drive that stays plugged in, or a backup share the attacker's compromised account can reach, may be encrypted along with everything else.
Test restores, not just backups
CISA tells organizations to regularly test the availability and integrity of backups in a disaster-recovery scenario. In practice, that means restoring a real system or folder on a schedule and timing how long it takes. A backup you have never restored is an assumption, not a plan.
Plan to rebuild, not just restore files
- Golden images: keep updated, preconfigured system images so you can redeploy servers or virtual machines quickly.
- Infrastructure as code: keep cloud templates under version control, with copies stored offline.
- Software and licenses: keep installers and license details with your offline backups, because images don't always install on different hardware.
A caveat on immutable storage
Some cloud providers offer immutable storage that protects data without a separate environment. CISA says to use it "with caution," because it may not meet some regulatory requirements and misconfiguration can be costly.
A small-team checklist
- Identify the data and systems you can't operate without.
- Keep at least one backup copy disconnected, or out of reach of everyday admin accounts, and encrypt it.
- Schedule a restore test and write down the result.
- Write a one-page incident response plan with phone numbers, kept on paper as well.
More: Cybersecurity coverage.
Sources
- #StopRansomware Guide — CISA and MS-ISAC (with NSA and FBI) · Primary source · accessed October 16, 2026Supports: Definition and double extortion; offline encrypted backups; testing; golden images; IaC; immutable storage caveat; incident response plan
About the author
Newsroom
IntechPulse Newsroom articles are drafted with AI assistance from the cited public sources and pass automated checks for sourcing and originality before publication. Unless an article shows a "Reviewed by" credit, it was not individually reviewed by a human editor. Corrections follow our Corrections Policy.
Related reading
CISA's KEV Catalog: How to Use It to Decide What to Patch First
CISA's Known Exploited Vulnerabilities catalog lists flaws attackers are already using. What qualifies, what the new BOD 26-04 changes, and how small IT teams can use it.
· 2 min read
Passkeys Explained: Why They Resist Phishing Better Than Codes
Passkeys use the same FIDO/WebAuthn standard CISA calls the gold standard for MFA. How they work, and why typed codes can be relayed but passkeys can't.
· 2 min read
Americans Contradict Themselves on Privacy
Incogni's survey of 1,517 U.S. adults found 45% say privacy doesn't concern them, yet most of that group still guards phones and cameras.
· 3 min read