Backup and Ransomware Preparedness for Brisbane SMBs: Restore Cleanly, Notify Correctly, Keep Trading
It is 6:47am on a Tuesday and your office manager rings to say nothing on the shared drive will open. By 8am you have found the ransom note, the file server is encrypted, and the backup NAS sitting next to it is encrypted too. Now the questions start coming fast: do you have a clean backup, when was it last tested, what data was on that server, and do you have to notify the OAIC because customer records were exposed? Backup and Ransomware Preparedness from Cyber by Exegesis is the engagement designed to answer those questions before the Tuesday morning phone call.
The problem
A ransomware incident at an Australian SMB is rarely just an availability problem. The same attacker that encrypts your files has usually had access for days or weeks beforehand, and the data they touched almost always includes personal information about customers, staff, or suppliers. That makes it a candidate for the OAIC Notifiable Data Breaches scheme — eligible breaches require notification to the OAIC and to affected individuals, and the clock starts running from the moment you become aware.
The ACSC Small Business Cyber Security Guide is blunt about what backup actually means in this context. A backup that sits on the same network as production, mounted with the same credentials, is not a backup — it is a second copy waiting to be encrypted. A backup that has never been restored is not a backup — it is an assumption. Most Brisbane SMBs have something they call a backup. Far fewer have one that is immutable, off-site, and restore-tested in the last 90 days.
What Backup and Ransomware Preparedness does
Cyber by Exegesis runs a fixed-scope engagement targeting the backup chain and the response plan together:
- A review of your backup chain against four practical criteria: frequency, immutability, off-site separation, and restore-tested. We document where each tier of data sits across each criterion.
- A restore test against one nominated critical system, run end-to-end, so you have evidence (not a vendor dashboard) that the chain works.
- A ransomware response plan written in plain English — who calls whom, who decides on isolation, who talks to the bank, who drafts the OAIC notification if the incident becomes an eligible data breach.
- A 90-minute tabletop exercise walking your leadership team through a realistic Brisbane SMB ransomware scenario, including the data-breach assessment decision.
- A short written report with what was tested, what passed, what failed, and a 90-day remediation window.
Cyber by Exegesis is the cyber consultancy line of Exegesis — the same company behind the DRMO live product. Our scope here is preparedness, not incident response. We set the chain and the plan; if the worst happens, you have something to execute against.
How it works
- We confirm scope on a short call, identify the systems and data classes in scope, and request read-only visibility into your current backup tooling.
- We map your backup chain against the four criteria and identify the weakest tier — usually either immutability or restore-testing.
- We run a live restore test against one nominated system into an isolated environment and time the result.
- We draft the ransomware response plan with you, including the OAIC NDB assessment branch, and document supplier and bank contact paths.
- We run the 90-minute tabletop with your leadership team and leave you with the written report and the 90-day remediation window.
Why this matters in Brisbane
Brisbane’s SMB base leans heavily on logistics, trades, healthcare, and professional services — sectors that hold customer PII (and in healthcare’s case, sensitive health information, which has stricter NDB implications). A ransomware event at a Brisbane medical practice, allied health clinic, or logistics SMB is almost always a data-breach event as well, which means the response has to satisfy both operational recovery and the OAIC’s notification requirements. Getting the backup chain and the response plan right ahead of time is the difference between two bad days and two bad quarters.
Sources
- ACSC Small Business Cyber Security Guide: https://www.cyber.gov.au/protect-yourself/resources-protect-yourself/personal-cyber-security-guides
- ACSC Essential Eight Maturity Model (Regular Backups mitigation strategy): https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight/essential-eight-maturity-model
- OAIC Notifiable Data Breaches scheme: https://www.oaic.gov.au/privacy/notifiable-data-breaches
- Cyber by Exegesis — Backup and Ransomware Preparedness (waitlist)
Join the waitlist
We are sequencing engagements by sector and by current backup posture (cloud-native tenants first, hybrid file-server environments second). Join the waitlist with your sector and a one-line description of where your backups currently sit — we will tell you when we are ready to take a brief from your business.