If you are a business owner, with or without a dedicated IT staff, documentation is not optional — it is the difference between a bad day and a business-ending event. Over the past twelve years I have watched businesses come to a complete halt because an MSP or IT staff member became unavailable, for any reason, and the next person had no map of the environment they were now responsible for. Whoever steps in next should not have to reverse-engineer your infrastructure. They should be able to open a folder and understand how everything works.

One case stands out clearly. A large manufacturing company had one systems administrator managing their entire infrastructure for over twenty years. He knew every server, every application dependency, every quirk of a network that had grown organically over a decade and a half. When he retired, none of that knowledge left with a handoff plan — it simply left.

Two weeks later, the environment was hit with ransomware.

The backups were gone — deleted by the threat actor before encryption began. Every server was encrypted. The infrastructure itself was over fifteen years old, built up in layers by one person who was no longer there to explain any of it. The only IT staff remaining was a helpdesk technician with minimal knowledge of how the environment was actually structured or managed.

The business had no choice but to pay the ransom to obtain a decryptor. But paying the ransom did not restore the business — it only unlocked the files. The owner then had to effectively become a systems administrator overnight, and our team had to reverse-engineer the infrastructure from scratch: where applications lived, how systems were connected, how access was structured, what depended on what. None of it was written down anywhere.

The business came to a complete standstill for two weeks while we assessed the damage, investigated every system, and worked to determine where critical applications were installed and what the realistic recovery and rebuild timeline would be for servers that were damaged beyond repair. Ransomware does not just lock data — it can corrupt it in ways that make it permanently unusable, and some of what was lost in this incident could not be recovered at all, regardless of the decryptor.

Here is what would have changed the outcome: documentation. Not perfect documentation — just documentation. If network diagrams, application dependency maps, and access records had existed, the investigation phase alone could have been cut from weeks to days. Recovery time is directly tied to how well an environment is understood before disaster strikes, not after.

This is true whether you have an internal IT department, an MSP, or a solo administrator. It is even more critical when new or outside IT takes over an environment — without documentation, every transition becomes a slow, expensive rediscovery process, and every incident becomes worse than it needed to be.

The moment you suspect ransomware or a compromise, the instinct is to panic. Understandable — but panic leads to mistakes, and some of those mistakes cannot be undone. Remain calm. What you do in the first hour matters more than almost anything that follows.

Contact your leadership chain of command, and contact your cybersecurity professional, cyber insurance provider, or legal counsel first — before any other decision is made. Disconnect network cables — ethernet cables, not power cables — from the firewall and from affected devices, or turn off Wi-Fi, to stop a Bad Actor from continuing to access or extract data. Note where each cable was connected, or take a picture, before you unplug it. Do not power anything off, and do not delete or wipe anything.

Do not contact or respond to the threat actor yourself. If contact needs to happen, it should be handled by your cybersecurity professional, and only after consulting counsel. Preserve what you can: photograph ransom notes exactly as they appear, and log the exact time you discovered the issue along with what you observed. Keep all details confidential — notify staff not to discuss the incident with family, friends, or on social media.

Check whether your backups are intact and isolated before assuming they are gone — but do not restore until the environment is contained, or you risk immediate re-encryption. Consult with counsel before reporting to law enforcement. Once systems are restored, take the time to understand how the attacker got in and close that door — an incident that repeats is far more damaging than the original event.