Ransomware headlines favor the spectacular. The cases that actually arrive are smaller and more ordinary: a mailbox rule, a remote-access tool someone approved in a hurry, a backup drive that was plugged into the same machine it was saving.
Five controls that change the outcome
Isolated backups. At least one copy of critical files should not be writable by the accounts people use all day. Then restore a real folder. A backup you have not opened is a rumor.
Fewer administrators. Daily work should not run as an admin. The account that can disable security should not be the account that reads email.
Patch the edge. Firewalls, VPN appliances, and the machines that hold files need updates on a schedule, not when someone remembers.
Mail that resists spoofing. Authentication records and filtering will not stop every lure. They stop the lazy ones, which are most of them.
A card, not a binder. One page: who to call, what to unplug, and the instruction not to pay or to wipe machines before anyone has looked. Put it where the office manager can find it.
None of this is glamorous. Together it is the difference between negotiating in the dark and returning to yesterday’s files.