Ransomware Prevention Checklist for Tampa Bay Small Businesses
Twelve things that keep a small office from paying a ransom or rebuilding from scratch, in the order we'd do them. Each one traces to the federal guidance from CISA and the FBI, with the parts that are different here in Florida.
The Short Answer
A ransomware prevention checklist for a small business in Tampa Bay should cover: backups that ransomware can't reach, test-restored, with one copy outside the hurricane zone; multi-factor sign-in on email, remote access, banking and admin accounts; no Remote Desktop open to the internet; patches on a schedule, firewall and VPN first; EDR on every computer, with someone reading its alerts; separate admin accounts; email filtering with SPF, DKIM and DMARC; staff who know how to report a suspicious message; encrypted laptops; a printed incident response plan with the FBI Tampa field office number (813-253-1000) on it; and a read-through of your cyber insurance policy and Florida's 30-day breach notice law before you ever need them.
Half of the twelve are free settings and an afternoon's work. The list follows CISA's #StopRansomware Guide and the practices the FBI Tampa field office asks local businesses to follow.
Why It Isn't Just About the Ransom
Ransomware locks your files, and today it usually steals a copy first, so the threat becomes “pay or we publish your client records.” CISA calls this double extortion. That changes the checklist: good backups get you running again, but they don't un-steal the data. So the list below has two jobs: keep attackers out, and make sure that if they get in, they can't stop you from recovering.
The Checklist
Make sure you can recover
Keep a backup ransomware can't reach, and test-restore it
CISA's first recommendation is offline, encrypted backups of critical data, tested regularly, because many ransomware variants hunt for backups it can delete or encrypt before it strikes. In practice: a backup that sits on a mapped drive or signs in with the same account as everyday work is not safe. The backup console gets its own login with multi-factor sign-in. Include the systems you'd forget: Microsoft 365 or Google Workspace mail and files, QuickBooks, your practice or case management software. Then actually restore a file, and once a year a whole computer, and write down how long it took.
Keep one copy outside the storm's reach
This is the Tampa Bay item. A backup drive in the same office can be lost to the same flood, the same power surge or the same attacker as the computers it protects. Keep at least one copy in the cloud, stored outside Florida, so a storm and an attack in the same week still leave you something to restore from.
Keep them out
Turn on multi-factor sign-in where it counts
Email first, then remote access and VPN, banking and payroll, accounting software, every admin account and the backup console. CISA recommends phishing-resistant MFA for all services, especially email and VPN. Prefer an authenticator app, a passkey or a security key over text-message codes. Free on Microsoft 365 and Google Workspace; it's a setting, not a purchase.
Close Remote Desktop to the internet
CISA tells organizations to audit for Remote Desktop (RDP, port 3389), close it where it isn't needed, and put multi-factor sign-in, lockouts and logging on what's left. If someone works from home, they connect through a VPN or a remote support tool with MFA, never straight to an office computer from the open internet. Ask whoever set up your router whether any port is forwarded to a PC. Many offices don't know.
Patch on a schedule, starting with what faces the internet
The firewall, VPN and router come first: CISA puts internet-facing devices at the top of the list. Then Windows and macOS, browsers, and the third-party apps that update themselves only sometimes (PDF readers, Zoom, Java). Replace anything that no longer gets security updates. “Someone remembers to do it” is not a schedule; automatic updates with a report that shows what installed is.
Give everyone a normal account, and admins a separate one
Nobody reads email or browses the web while signed in as an administrator; ransomware runs with the rights of whoever opened it. Give staff access to the folders their job needs, not the whole server. Remove former employees and contractors the day they leave (our offboarding checklist has the order).
Filter email, and set up SPF, DKIM and DMARC
Most attacks still start with an email. Use the filtering built into Microsoft 365 or Google Workspace, set to block the attachment types your office never needs. CISA also recommends DMARC, which stops criminals sending mail that pretends to come from your domain. It protects your clients from fake mail “from you”; it doesn't stop fake mail coming in, which is what the next item is for.
Teach staff to report, and make it easy
A short, regular reminder of what a phishing email looks like does more than a long annual training. The part most offices skip: one obvious way to report a suspicious message, and a thank-you rather than blame when someone clicked and says so. The click someone reports in five minutes is a small problem. The one they hide until Monday is not. For payment and bank-detail changes, a phone call to a number you already have, every time (see our wire fraud guide).
Catch it and stop it
EDR on every computer and server, with someone reading the alerts
Traditional antivirus matches files against a list of known threats. Endpoint detection and response (EDR) watches what programs do, which is how ransomware gets caught when it's new. CISA recommends EDR or application allowlisting on all assets. An alert nobody reads is a log of what went wrong, so decide who sees it, including at night and on weekends. Our plain-English EDR guide and MDR vs. antivirus explain the difference.
Encrypt every laptop
BitLocker on Windows, FileVault on a Mac, with the recovery key stored somewhere other than the laptop. It matters for ransomware because attackers now often steal data as well as lock it, and Florida's breach law (section 501.171) leaves information that is encrypted, or otherwise made unusable, out of the definition of personal information it covers. A stolen encrypted laptop is a much smaller event than an unencrypted one.
Be ready before it happens
Write a one-page incident plan, and print it
CISA's advice is a basic incident response plan with a hard copy and an offline version, because the plan saved only on the server is locked along with everything else. One page is enough: who decides, who to call (your IT provider, your insurer's claims or breach hotline, your attorney, the FBI Tampa field office at 813-253-1000), how to unplug an infected computer from the network, where the backups are and who can sign in to them. Keep a copy at home and in the owner's car.
Read your cyber policy and Florida's notice law now
Some cyber insurance policies require you to call the insurer first and use its approved vendors; hiring someone on your own can complicate the claim, so find out today whether yours does. Florida requires businesses to take reasonable measures to protect personal information, to notify affected Floridians no later than 30 days after determining a breach, and to notify the Florida Attorney General's office (the Department of Legal Affairs) within 30 days when 500 or more Floridians are affected (s. 501.171, Florida Statutes). Which of that applies to a given incident is a question for your attorney; knowing the clock exists is the part that belongs on the checklist. Insurance applications ask about most of the items above, and our cyber insurance questionnaire guide walks through them.
If It Happens Anyway: The First Moves
- Disconnect, don't wipe. Unplug the network cable or turn off Wi-Fi on the affected computers. CISA advises powering a device down only if you can't disconnect it. Don't delete anything or start reinstalling: the evidence is how you find out what was taken.
- Call your IT provider, then your insurer's hotline. In that order if the insurer allows it, or the reverse if your policy says so (item 12).
- Report it. To the FBI Tampa field office at 813-253-1000 or online at ic3.gov. The FBI says it does not encourage paying a ransom, and that paying does not guarantee you get your files back.
- Call your attorney before you notify clients, so the 30-day Florida clock is handled properly.
What It Costs
Honest version: a lot of this list is free, and you can do it yourself. Where it isn't, here is what we charge, so you can compare.
| Items | Do it yourself | Where Bay Geeks fits |
|---|---|---|
| MFA (3), closing RDP (4), separate admin accounts (6), reporting habit (8), printed plan (11), policy and law review (12) | Free. Settings and an afternoon. | We can set them up at our business rate, $175 an hour, if you'd rather not. |
| Backups (1, 2), patching (5), EDR with automatic isolation and rollback (9) | Possible, but someone has to check them every week. | Automated plan, $75 per computer a month: Bay Geeks EDR, unlimited cloud backup, tested patching including third-party apps, vulnerability scans. |
| Someone reading the alerts at 2 a.m. (9) | Hard for a small office. | Advanced plan, $150 per device a month, adds 24/7 monitoring by Bay Geeks SOC. |
| Not sure where you stand on any of it | Work through the self-check below. | Business Risk Assessment, $495 flat for up to 10 computers, credited toward a plan if you start one within 30 days. |
Plans have a 12-month initial term; the plan page has the full terms. CISA also keeps a list of no-cost security services and tools, its own and other organizations', on its Cyber Resource Hub. Some are aimed at critical infrastructure and government, but it's worth a look before you pay anyone.
Quick Self-Check
| Question | If “no” or “not sure”... |
|---|---|
| Have you restored a file from backup in the last six months, and could ransomware on an office PC reach that backup? | Items 1 and 2 |
| Does every email account, including the owner's, need a second step to sign in? | Item 3 |
| Can anyone reach an office computer directly from the internet? | Item 4 |
| When did the firewall last get a firmware update? | Item 5 |
| Who sees a security alert on a Saturday night? | Item 9 |
| If the server were locked right now, is there a paper copy of who to call? | Item 11 |
Find Out Where You Stand
Our Business Risk Assessment checks your office against this list and more, then gives you a ranked, priced report. Fix it yourself, with your current IT provider, or with us: the report is yours either way.
Frequently Asked Questions
Are small businesses really targets?
Yes. CISA's guide describes the damage as costly for organizations of all sizes, and the FBI Tampa field office's ransomware warning was addressed to public and private sector businesses generally, not only large ones. Small offices are attractive because they often have the same software as big ones with fewer people watching it.
Should we pay the ransom?
The FBI does not encourage it: paying funds the next attack and doesn't guarantee your files come back. It is a business decision you'd make with your attorney, your insurer and law enforcement, which is why item 11 puts their numbers on paper now. Good backups are what make “no” an easy answer.
Who do we call in Tampa Bay if ransomware hits?
Your IT provider and your insurer's breach hotline first, then report it to the FBI Tampa field office, 5525 West Gray Street, Tampa, at 813-253-1000, or online at ic3.gov. Call your attorney before notifying clients. If you don't have an IT provider, call us at 727-579-4335.
Does Florida law require us to tell anyone?
If personal information was accessed, usually yes. Section 501.171 of the Florida Statutes requires notice to affected individuals in Florida no later than 30 days after a breach is determined, and to the Department of Legal Affairs when 500 or more Floridians are affected. Your attorney decides how it applies to your incident.
Is antivirus enough?
Not anymore. Antivirus recognizes known threats; EDR watches behavior, so it can catch ransomware that is new, isolate the computer and, with Bay Geeks EDR, roll the files back. See Antivirus Isn't Enough Anymore.
How much does ransomware protection cost a small business?
About half of this checklist is free settings. Our Automated plan covers the backup, patching and EDR items for $75 per computer a month, and the Advanced plan adds 24/7 monitoring for $150 per device. The table above maps each item to its cost.
Sources
- CISA, MS-ISAC, NSA and FBI, #StopRansomware Guide (updated September 2023): offline encrypted backups, phishing-resistant MFA, RDP, DMARC, EDR, a printed incident response plan.
- FBI Tampa, FBI Tampa Asking Businesses to Bolster Defenses Against Ransomware (March 15, 2022): recommended practices, the FBI's position on paying, how to report.
- FBI Tampa field office: 813-253-1000, 5525 West Gray Street, Tampa (checked October 24, 2026).
- Section 501.171, Florida Statutes (2026): security of confidential personal information.
Related guides
How business email compromise moves real money, and the callback rule that stops it.
What to do (and what to stop doing) when a drive starts clicking, before the data is gone for good.
Take the account back, sign out every session, and find the forwarding rule they left behind.
Cut the connection, call the bank from another device, and what to check before that computer goes back online.
📞 727-579-4335 · ✉️ support@baygeeks.com · Privacy Policy · Terms of Service