Backup and Ransomware Preparedness for Melbourne SMBs: Know You Can Restore Before You Have To
Your operations manager rings on a Tuesday morning to say the file server is throwing errors and nobody can open the shared drive. By the time you log in, every document has the same unfamiliar extension and there is a text file on the desktop with payment instructions in broken English. You go to check your backups — and realise nobody has actually tried to restore from them in over a year. Backup and Ransomware Preparedness from Cyber by Exegesis is the engagement designed to make sure a Melbourne SMB never has to find that out the hard way.
The problem
Ransomware is the highest-impact cyber loss category for Australian SMBs, and the ACSC Small Business Cyber Security Guide is blunt about why: the control that matters is not the antivirus, it is the backup chain. Attackers expect you to have backups. Modern ransomware actively searches for and encrypts (or deletes) connected backup targets before triggering the ransom note. If your backup is a USB drive plugged into the server, or a network share the domain admin can write to, you do not have a backup — you have a copy that will be encrypted alongside everything else.
The other half of the problem is restore-testing. Most SMBs we speak with have some backup running. Very few have ever performed a full restore drill. The first time you discover the backup is corrupt, mis-scoped, or missing the database transaction logs is the worst possible time to discover it. And under the OAIC Notifiable Data Breaches scheme, a ransomware incident that exposes customer personal information may be an eligible data breach you are required to notify — which means your incident response plan needs to exist before the incident, not after.
What Backup and Ransomware Preparedness does
Cyber by Exegesis runs a fixed-scope engagement focused entirely on whether your business can recover:
- A review of your backup chain — frequency, retention, immutability, off-site/off-network separation, and whether backup credentials are isolated from your production domain.
- A restore test. We pick a representative file set, a representative database, and a representative endpoint, and we restore them to confirm the backups actually work. This is the step almost nobody does.
- A ransomware response plan written in plain English — who decides, who calls the bank, who calls the insurer, who calls the OAIC, who talks to staff, who talks to customers, and in what order.
- A 90-minute tabletop exercise walking your leadership through a realistic Melbourne SMB ransomware scenario, including the decision points around payment, notification, and operational continuity.
- A short written report with what passed, what failed, what to remediate, and a 90-day review window.
Cyber by Exegesis is the cyber consultancy line of Exegesis — the same company behind the DRMO live product. Our scope here is preparedness. We are not your IT provider and we are not your incident responder; we test the chain, write the plan, and run the drill.
How it works
- We confirm scope on a short call, identify the systems and data sets in scope, and request read-only visibility into your backup tooling and your production environment.
- We document the current backup chain end-to-end and identify where it does and does not meet the ACSC Small Business Cyber Security Guide’s expectations around separation and immutability.
- We run the restore test against representative file, database, and endpoint targets and record what actually came back.
- We draft the ransomware response plan with your leadership, mapping it to OAIC NDB obligations where customer PII is in scope.
- We run the 90-minute tabletop exercise and leave you with the written report and the 90-day review window.
Why this matters in Melbourne
Melbourne’s SMB base skews towards manufacturing, logistics, healthcare practices, and professional services — sectors where a day of downtime is operationally and reputationally expensive, and where customer or patient PII often sits on the same file servers ransomware targets first. A Melbourne SMB that has tested its restore path, isolated its backup credentials, and rehearsed its response plan will recover from a ransomware incident in days rather than weeks — and will know, on day one, whether the OAIC needs to be notified. That is the difference between a bad week and an existential event.
Sources
- ACSC Small Business Cyber Security Guide: https://www.cyber.gov.au/protect-yourself/resources-protect-yourself/personal-cyber-security-guides
- ACSC Essential Eight Maturity Model (Regular Backups is one of the eight): https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight/essential-eight-maturity-model
- OAIC Notifiable Data Breaches scheme: https://www.oaic.gov.au/privacy/notifiable-data-breaches
- ACCC Scamwatch (National Anti-Scam Centre): https://www.scamwatch.gov.au/
- Cyber by Exegesis — Backup and Ransomware Preparedness (waitlist)
Join the waitlist
We are sequencing engagements by sector and by backup tooling in use. Join the waitlist with your sector, headcount, and current backup product — we will tell you when we are ready to take a brief from your business.