Ransomware is a shakedown with a very specific business model. Attackers get into your systems, scramble every file so you can’t open it, and then offer to sell you the key. Member records, financial files, years of documents — all still there, all suddenly unreadable, with a countdown clock and a ransom demand attached. It’s frightening precisely because it takes your own information hostage.
But that whole model has one fatal weakness, and it’s not clever software. It’s a good backup. If you have a clean, recent copy of your files stored somewhere the attacker couldn’t reach, their leverage evaporates. You don’t negotiate and you don’t pay; you wipe the affected machines, restore from your copy, and get back to work. The ransom only works if the backup doesn’t exist. So the single most powerful thing a small organization can do against ransomware isn’t buying protection — it’s making sure a copy of everything important lives somewhere safe.
The rule that’s easy to remember: 3-2-1
Security professionals boil good backups down to three numbers, and the reason it’s endured is that it’s genuinely easy to hold in your head. Keep three copies of your important data, on two different kinds of storage, with one of them kept somewhere else entirely.
Three copies means the original you work with plus two backups, so that no single failure wipes you out. Two kinds of storage means you don’t put all your trust in one basket — for example, the working copy on your computer and a backup in a cloud service, rather than two folders on the same hard drive that dies together. And one copy kept off-site, away from your building, protects you against the physical disasters that a purely local backup can’t survive: a fire, a flood, a stolen laptop, or a burst pipe over the church office. For most small organizations today, that off-site copy is a reputable cloud backup, which quietly handles the “somewhere else” part for you.
You don’t need expensive equipment to follow this. A church that keeps its files in Microsoft 365 or Google Workspace, plus a separate backup service or an external drive stored off-site, is already living the rule.
The trap: the copy ransomware can also reach
Here’s the detail that trips up organizations that thought they were covered. Ransomware doesn’t only scramble the computer it lands on. It reaches out to everything that computer is connected to — the shared network drive, the always-connected external disk, sometimes the synced cloud folder — and scrambles those too. A backup that’s plugged in and reachable all the time can get encrypted right alongside the original, which is a devastating thing to discover on the worst day.
The protection is to keep at least one backup that isn’t constantly connected — what the pros call an offline or “air-gapped” copy, and what you can think of as a backup the ransomware simply can’t touch because there’s nothing linking the two. In practice that means an external drive you plug in for the backup and then unplug and put away, or a cloud backup service that keeps older versions the attacker can’t reach in and delete. The principle is the same either way: your safety copy should not be sitting there, always online, waiting to be scrambled with everything else.
Cloud services help here in a way worth understanding. Many keep version history, meaning they hold earlier copies of your files even after the current ones change. If ransomware encrypts your synced documents, that version history can often let you roll back to the clean versions from before the attack. It’s not automatic and it’s not infinite, so it’s worth confirming your service offers it and knowing how to use it — but it’s a real advantage that a plain external drive doesn’t give you.
The step almost everyone skips: test the restore
This is the part that separates organizations that survive from ones that only thought they were protected. A backup you have never restored from is not a backup — it’s a hope. The time to discover that your backup was silently failing for six months, or that nobody knows the password to the backup account, or that the files won’t actually open, is not the morning after an attack.
So test it, and test it before you need it. Once, pick a few real files, delete them from your working copy (or better, restore them to a separate folder so you don’t disturb anything), and bring them back from your backup. Confirm they open and they’re current. Do this when you first set up your backups and then on a simple schedule — a quarterly reminder on the calendar is plenty for most small organizations. The whole exercise takes fifteen minutes and converts a hope into a certainty.
What to make sure is actually covered
As you set this up, walk through where your important information actually lives, because it’s easy to back up the obvious things and miss the ones that would hurt most. Your email and shared documents are the big ones. But also think about your member and donor records, which often live inside a church management or database platform — check whether that platform backs itself up or whether that’s on you. The same goes for your bookkeeping and giving data. You don’t have to solve all of it in a day; you just want an honest inventory of what would be catastrophic to lose, and a copy of each of those things somewhere safe.
Ransomware is designed to make you feel powerless, and against an organization with no backups, it is. Against one with three copies, one of them offline, and a restore they’ve actually tested, it’s an expensive nuisance that ends with you shrugging and restoring your files. That difference is entirely within your control, and it costs far less than most people assume.
A good backup is your safety net for when something slips through. Turning on multi-factor authentication is how you stop most attacks from slipping through in the first place — the two work best as a pair, one preventing trouble and the other making sure it can’t become a disaster.
If you’d like a clear read on whether your current backups would actually survive an attack, that’s one of the things our free assessment checks. Get on the launch list and you’ll be first in line when it opens.
Sources
- Cybersecurity and Infrastructure Security Agency (CISA), #StopRansomware Guide and Protecting Against Ransomware — on offline backups and the 3-2-1 approach, cisa.gov.
- National Institute of Standards and Technology (NIST), Data Integrity: Recovering from Ransomware and Other Destructive Events — nist.gov.
- Cybersecurity and Infrastructure Security Agency (CISA), guidance on testing backups and maintaining offline copies, cisa.gov.