Ransomware rules for small businesses: what is proposed and what to do now

Ransomware sounds like a problem for hospitals and big corporations. It is not. It is malicious software that locks your files so you cannot open them, and the criminals then demand payment, usually in cryptocurrency, to give them back. They may also threaten to publish data they have copied. The Home Office has been working on new rules about ransomware, and the direction of travel matters even for a business with five staff. This post explains what is proposed, what is still unknown, and the practical steps worth taking this week.

What the government has proposed

The Home Office ran a consultation on ransomware from 13 January to 8 April 2025, and published its response on 22 July 2025. The consultation page says the aim of the legislation is to reduce the money flowing to ransomware criminals from the UK, improve the ability of agencies to disrupt and investigate the criminals, and strengthen understanding of the threat.

According to a summary of the response by law firm Slaughter and May, there are three proposals:

• A partial payment ban. This covers the public sector and critical national infrastructure. A small private business is not covered by this part.
• A payment prevention regime. Victims who are not covered by the ban would have to tell the authorities if they intend to pay, so that the authorities can check for reasons to block the payment, such as sanctions. Victims who comply would get proof of engagement to show payment brokers or facilitators that they followed the process.
• Mandatory incident reporting. All ransomware victims would report within 72 hours, whether or not they intend to pay, followed by a detailed report within 28 days. The summary describes this as economy wide.

The word to notice is "economy wide". If that survives into law, a small firm hit by ransomware could have a legal duty to report it, even though the payment ban itself is aimed at the public sector.

What is still unknown

This is the part to be honest about. The Slaughter and May summary says the government was still exploring how to implement the payment prevention regime and that no timeframe had been set for next steps. When I looked for the current position, I could not find a published bill or a start date, and the gov.uk consultation page simply says the consultation has concluded. So these are confirmed intentions, not rules you must follow today. Details such as penalties, and whether a turnover threshold will exclude the smallest firms, were not settled in the material I read. Check gov.uk before you rely on any of this.

What people think about it

Reaction has been mixed rather than hostile. A round-up of views published by TechInformed in July 2025 shows supporters, including the Security Minister Dan Jarvis and the former NCSC chief executive Ciaran Martin, who backs mandatory reporting. Their argument is that cutting off payments makes the criminal business model less attractive and that better reporting gives a clearer picture of the threat.

Critics raise practical worries. One lawyer quoted warns that a ban could push criminals further underground and that victims should not be criminalised. A security vendor warns that some firms might pay and simply not report it. And a representative of NCC Group warned that attacks could shift towards non-critical sectors such as manufacturing and small and medium sized businesses. That last point is the one worth a small business owner's attention: protecting the biggest targets does not automatically protect you.

What the NCSC says you should do

Whatever the final law looks like, the National Cyber Security Centre's advice is already clear. On its ransomware page it says you should always have a recent offline backup of your most important files and data, because an offline copy cannot be encrypted along with everything else. It also points to its free Early Warning service, which sends notifications about malicious activity to UK organisations.

Its Small Organisations Guide to cyber security adds the detail on backups:

• Back up all the data your business needs to operate, such as your website, emails, invoicing, documents, contacts and customer information.
• Use online storage if you have reliable internet, and an external drive if you do not. For maximum safety use both, so that if one is lost, stolen or fails you still have another.
• Keep an external drive somewhere secure and disconnect it when you are not using it, because some viruses will also affect devices connected to an infected computer.
• Protect online backups with two-step verification.
• Learn how to restore your backup before you need to, and check it contains all your important data.

The same guide says one in two small businesses suffer a cyber incident every year and that small organisations are just as likely to experience online crime as larger ones. It also says many of its recommendations can be completed in as little as five minutes.

If you are hit

The NCSC says how you respond will hugely affect the impact of an attack, and it recommends using an NCSC-assured Cyber Incident Response provider, for all UK organisations regardless of size or sector. Agreeing who you would call before a crisis is much easier than searching in the middle of one.

On paying, the NCSC and UK law enforcement do not encourage, endorse or condone it. Its reasons are that paying does not guarantee you will regain access to your data or computer, your systems may remain infected, you would be funding criminal groups, and you may be targeted again. You can report an incident through gov.uk/report-cyber. If the proposed rules arrive, expect that reporting step to become a legal one for many firms.

A checklist for this week

• Find out what you actually back up. Include the things people forget: the website, the email account, the accounting package and the customer list.
• Make sure one copy is offline or disconnected. Cloud storage alone can be reached by an attacker who gets into your account, which is why two-step verification on it matters.
• Do a test restore. Pick one important folder and restore it to a different device. If you cannot, you do not yet have a working backup.
• Write down a one page plan. Who makes decisions, who you phone for IT help, which incident response provider you would use, and where the contact details are kept somewhere that does not depend on your own network.
• Check your suppliers. Ask whoever hosts your website or looks after your IT how they back up and how quickly they could restore.
• Sign up to Early Warning. It is free.

If you would like help reviewing your hosting, backups and access controls, our cloud and security work covers exactly that. The proposed ransomware rules may take time to arrive, but a tested backup protects your business whenever they do.