Ransomware Recovery Time: How Fast Could an SME With No IT Team Get Back to Trading?

If your company has no IT team and has never run a restore test, the honest answer is three to ten working days to get back to normal trading, not the few hours most owners assume. The gap is almost never the backup itself. It is the hours lost finding who holds the admin password, rebuilding laptops one at a time, re-entering orders that were taken on paper while systems were down, and discovering that the one system nobody backed up was the one that prices your jobs. In October that gap is an inconvenience. In the second week of December it is a lost quarter.

What Is Your Recovery Time Objective, in Plain Money?

Two numbers decide everything, and you can set both in half an hour without any technical knowledge.

The first is how long you can be down before the damage stops being recoverable. For a retailer in peak season that might be four hours. For a professional services firm in a quiet February it might be three days. The second is how much recent work you can afford to lose and re-enter by hand: one hour of orders, one day, one week.

Put a dollar figure beside each. If you trade S$18,000 on a good December day, a three-day outage is roughly S$54,000 of revenue plus the staff cost of catching up and the customers who buy elsewhere and do not come back. That number is what justifies spending a few hundred dollars a month on something better. Without it, every backup conversation turns into a discussion about storage prices, which is the wrong argument.

Why Does Cloud Sync Fail as a Ransomware Backup?

Most SMEs believe they are covered because files live in Microsoft 365, Google Drive or Dropbox. Sync is not backup, and the distinction matters specifically in a ransomware event.

Sync does exactly what it is designed to do: it copies what is on the laptop up to the cloud. When ransomware encrypts the laptop, the sync client dutifully copies the encrypted versions over the good ones. Microsoft and Google do keep version history and a recycle bin, so recovery is usually possible, but it is a file-by-file or folder-level rollback performed by somebody who knows the admin console, under pressure, across every affected user. That is a day of work, not a button.

Three things are commonly missing entirely:

• The accounting system. If it runs on a PC in the back office, the data file is often outside any cloud folder.
• Email. Mailboxes are rarely backed up separately from the platform that hosts them.
• The shared drive nobody owns. Usually a NAS, usually reachable from every laptop, usually with one password shared by everyone, which is the single easiest path for ransomware to reach everything at once.

The working rule is one copy off the network entirely, in a place that your own staff logins cannot delete. If the ransomware can reach your backup using credentials from an infected laptop, you do not have a backup.

What Does a Real Restore Test Look Like for a Twelve-Person Company?

A restore test is not an IT project. Block two hours on a Friday afternoon and do this:

1. Pick the three systems the business genuinely cannot trade without. Usually accounting, customer orders and email.
2. For each one, restore it somewhere harmless. A spare laptop, a separate folder, a trial cloud instance.
3. Start a timer when you begin and stop it when a normal staff member can do normal work in the restored copy.
4. Write down the number and what went wrong. Something always does.

The findings are predictable and valuable. The backup covered the folder but not the database. The licence key is in an email inside the mailbox you cannot reach. The admin account belongs to a staff member who left in March. The restore worked but took six hours because the upload was throttled. Each of these is cheap to fix on a Friday afternoon and expensive to discover on a Monday morning in December.

Do it twice a year and record the date. That record is what turns a vague assurance into a defensible answer.

Who Is Going to Ask You for This Number?

Increasingly, your customers. Larger buyers and multinationals now push security questions down their supply chain, and the questions are specific: do you hold the CSA Cyber Essentials mark, when did you last test a restore, how quickly can you resume service. An SME that answers with a documented recovery time wins work that an SME answering with a shrug does not.

Cyber insurers ask the same thing, and a claim can be contested if the controls you declared were never in place. The Cyber Essentials mark itself expects backups to be in place and tested, which is useful leverage internally because it converts a nagging worry into a checklist item with an owner.

There is also a legal clock. Under the PDPA, a data breach that is likely to cause significant harm, or that affects 500 or more individuals, must be notified to the PDPC no later than three calendar days after you assess that it is notifiable, with affected individuals told as soon as practicable. Three calendar days includes the weekend. You cannot meet that deadline if the first two days go on working out which systems were touched, which is why a current list of where customer data actually lives is part of recovery readiness and not a separate compliance chore.

What Should You Do Before the December Peak?

Five actions, all completable in October by someone who is not technical:

• List your three critical systems and name one person responsible for each.
• Confirm one backup copy sits outside your network and cannot be deleted with a staff login.
• Run one timed restore test and write the number down.
• Collect admin credentials for every critical system into a password manager the owner controls, not an individual employee's account.
• Write a one-page manual fallback: how staff take and record an order with no systems at all, and who tells customers what.

That last page is the one that saves the quarter. Systems come back eventually. Trading has to continue in the meantime.

Frequently Asked Questions

How much should a Singapore SME expect to pay for proper backup and recovery?

For a business of ten to thirty staff, budget roughly S$100 to S$400 a month for managed cloud backup covering mailboxes, shared files and one line-of-business database, plus a few hundred dollars a year if you want an offline copy as well. Compare that against one day of lost December revenue before deciding it is expensive.

Should we pay the ransom if our backups fail?

Treat it as a last resort and involve the police and your insurer first. Payment does not guarantee a working decryption key, does not remove the attacker's copy of your data, and does not discharge your PDPA notification duty. The reason to invest in a tested restore is precisely so this is never the decision in front of you.

Does cyber insurance replace having tested backups?

No. Insurance pays for some of the loss after the event; it does not shorten the outage, and insurers increasingly ask what controls you had before quoting or paying. A tested restore reduces both the downtime and the premium argument.