Ransomware Readiness: The First Five Things to Do — For Companies Without IT Staff

There is no shortage of ransomware advice, but a company without IT staff cannot do all of it. This guide works backwards from how attacks actually get in, and covers only the first five things — in the order to do them.

Why the order matters

According to the National Police Agency, 226 ransomware cases were reported in Japan in 2025, and 143 of them were at small and mid-sized companies. In a follow-up survey of affected organisations (92 valid responses), 61 intrusions (66.3%) used a VPN device and 19 (20.7%) used remote desktop — about 90% combined.

In other words, attackers usually do not use exotic methods. They come through the doors that let people in from outside. The order of your defences should match that reality.

Point 1: Find the entrances from outside, and update them

First, list every way someone can reach your network from outside: VPN devices, remote desktop, remote-support tools.

• Update the firmware (the device's own software) of VPN devices and routers
• Stop or remove remote connections nobody uses anymore
• Plan to replace old devices whose support has ended — they can no longer be updated at all

If you are not sure what the entrances are, ask: "Can anyone reach the office systems from a home computer?" That question finds most of them.

Point 2: Double the locks (multi-factor authentication)

Set up multi-factor authentication so that a stolen password alone is not enough. Priorities: administrator accounts for VPN and remote desktop, email, and cloud-service administrators.

Also stop reusing passwords, and replace guessable ones. Our guide "Stop Reusing Passwords — The First Step" covers how.

Point 3: Put updates on automatic

Updating the OS and apps closes the doors attacks use. The first of IPA's Five Information Security Articles is exactly this: keep the OS and software up to date.

• Turn on automatic updates for the OS, browsers and business apps
• Install anti-virus software and let its definitions update automatically (the second of the Five Articles)
• Pick a day each month to check that no updates are piling up

Point 4: Keep backups you can actually restore

Ransomware often encrypts backups on the same network, too. What matters is having a copy it cannot reach.

• Keep 3 copies of important data, on 2 kinds of storage, with 1 copy disconnected from the network (the 3-2-1 idea)
• Connect the disconnected storage (such as an external drive) only while backing up
• Test that you can restore — a backup that was never tested is a hope, not a backup

You can try the numbers for your own company with the free Backup 3-2-1 Design Simulator.

Point 5: Decide the first response before you need it

Right after an incident, there is no time to think. Decide these in advance:

• If a computer looks infected, disconnect it from the network (unplug the LAN cable, turn off Wi-Fi) but leave the power on
• Write the contact list on paper: the owner, your IT support contact, the police cybercrime consultation desk, and IPA's information security consultation desk
• Do not pay a ransom. Payment does not guarantee your data back, and the police and IPA advise against paying

Summary: today's checklist

• Listed the entrances from outside (VPN, remote access) and checked device updates
• Set multi-factor authentication on administrator accounts and remote access
• Turned on automatic updates for the OS, apps and anti-virus software
• Arranged backups in the 3-2-1 shape and tested a restore
• Prepared the first-response contact list on paper

Check your understanding

Tap an answer to check yourself. Nothing is saved or sent.

Q1. In the National Police Agency survey, what was the most common ransomware intrusion route?

VPN devicesUSB drivesThe company website

See the answer

Of 92 valid responses, 61 (66.3%) used a VPN device and 19 (20.7%) used remote desktop — about 90% combined.

Q2. In backup "3-2-1", why keep one copy disconnected from the network?

To make storage cheaperSo ransomware cannot encrypt it together with the originalTo make restores faster

See the answer

A backup on the same network can be encrypted along with the original. A disconnected copy survives and can be restored from.

Q3. You find a computer that looks infected. What is the first move?

Turn the power off and waitDisconnect it from the network and leave the power onPrepare to pay the ransom

See the answer

Disconnecting stops the spread. Turning the power off can erase records the investigation needs. Paying is not recommended.

Read next

See the latest threat intelligence

Start Here — security in 3 steps

← Back to the guide list