A malware defence plan a small business can actually run

A malware defence plan is only worth writing if someone can carry it out on a Tuesday morning with the phone ringing. The workable version for a business of five people or fifty is short, mostly automatic, and built on a handful of controls that the FTC, CISA and the FBI all name in plain language. Here is that version, plus the numbers you should call if it fails.

What the plan is defending against, in order of likelihood

The 2025 IC3 Annual Report puts phishing and spoofing first by complaint volume, with 191,561 complaints and $215,843,126 in reported losses, out of 1,008,597 complaints and $20.877 billion in total losses. Ransomware, the threat most defence plans are written around, accounted for 3,611 complaints and $32,320,105, with 63 new variants identified.

That ordering matters for where you spend effort. The everyday event is not an encrypted server. It is a member of staff being persuaded to hand over a credential or open a file, which is also the route by which the encrypted server eventually happens.

The four protections to put in first, all of them automatic

The FTC’s baseline list is short enough to finish in an afternoon:

CISA’s instruction on updates is to remove the human from the loop entirely: turn on automatic updates so devices install them without any input from us as soon as the update is available. Its stated reason is blunt — “Malicious online criminals won’t wait, so we shouldn’t either!”

CISA also puts part of this on your suppliers. If a provider does not offer automatic updates, CISA’s line is that you should question them, because “It’s your information they’re putting at risk!” That is a fair question to ask at renewal.

1. Install security software on every machine and set it to update automatically.
2. Set every phone to update its operating system automatically.
3. Turn on multi-factor authentication, which the FTC describes as requiring two or more credentials to log in.
4. Back data up to an external drive or to cloud storage.

The three controls the #StopRansomware Guide puts first

The word doing the work in the first line is phishing-resistant. CISA’s MFA hierarchy ranks four tiers, with FIDO/WebAuthn and PKI at the top and SMS or voice codes at the bottom, described as vulnerable to phishing, SS7 and SIM swap attacks. CISA states that the only widely available phishing-resistant authentication is FIDO/WebAuthn.

None of that is an argument for switching MFA off while you shop around. CISA’s position remains that any MFA is better than no MFA. It is an argument for putting the strongest available option on the email account first, because that is the account attackers use to reset all the others.

• Implement phishing-resistant MFA for all services, particularly for email, VPNs, and accounts that access critical systems.
• Maintain offline, encrypted backups of critical data, and regularly test the availability and integrity of those backups.
• Regularly patch and update software and operating systems to the latest available versions.

How to check the plan is real and not just written down

1. Restore one real file from your backup to a machine that has never held it, and time how long it takes.
2. Unplug the backup drive afterwards. CISA’s guidance is to avoid leaving an external drive connected when you are not actively backing up, and to store it somewhere safe.
3. Open the update settings on three random devices and confirm automatic updates are on.
4. Try to log in to company email with the password alone. If it works, MFA is not enforced.
5. Ask one member of staff what they would do with a suspicious email. The answer you want is CISA’s: resist clicking, report it, delete it.

Who to contact on the day it goes wrong

• CISA, for ransomware technical assistance: Central@cisa.dhs.gov or 1-844-729-2472.
• The FBI’s Internet Crime Complaint Center at IC3.gov.
• The FTC at ReportFraud.ftc.gov.
• IdentityTheft.gov, if anyone handed over a Social Security number, card or bank account details.
• Phishing email forwarded to reportphishing@apwg.org; phishing texts forwarded to SPAM (7726).

Where the plan stops helping

This is general reasoning rather than a sourced claim, but worth saying: a defence plan covers your machines and your accounts. It does not cover a supplier who is breached and loses your customer data, and it does not undo a payment already sent.

The FTC’s own removal path ends at a hard limit too. If security software and a full scan do not clear the infection, the remaining step is to recover or reinstall the operating system using instructions from the manufacturer’s website. Plan for the possibility that a machine gets rebuilt, and you will find the backup test above was the most useful hour you spent.

Sources: CISA — #StopRansomware Guide · FTC — How to recognize and avoid phishing scams · FBI — Ransomware · FBI IC3 — 2025 Internet Crime Report · CISA — Update software

Reviewed 27 August 2026 by the CyberArtical editorial team against primary guidance from CISA, the FTC and the FBI. Security guidance changes over time; where our earlier version of this page said something different, we say so in the article rather than editing it out quietly.