State law says we cannot pay a ransom. What does that mean for our backups?

Florida Statute 282.3186 prohibits a county or municipality experiencing a ransomware incident from paying or otherwise complying with a ransom demand. Whatever you think of that as policy, it settles your recovery strategy completely: the decryption key is not available to you, so the only way back is your own data.

That raises the bar on backups in three specific ways.

• The backup has to survive the attack. Modern ransomware looks for backups first and encrypts or deletes them, and it will use the credentials it stole to do it. A backup on a network share, or on a USB drive left plugged in, or in a cloud account reachable with a domain admin password, is not a backup for this purpose. What we want is immutable or offline copies that cannot be altered even by someone holding your administrator credentials.
• It has to be tested by restoring, not by reading the report. A green checkmark says a job ran. It does not say the data is usable, that the application will come back up, or how long it takes. We do test restores and we tell you the real recovery time, including the number you will not like.
• You need a recovery order decided in advance. When everything is down, the sequence matters. For most towns it is finance and payroll, utility billing, then everything else, but that is a decision for your manager and clerk rather than for us, and it is much easier made in a meeting than during an outage.

How our backups work, since it comes up: Microsoft 365 and Google Workspace backup is included in the per user model. Server backups are billed separately per server and include up to 1 TB of storage per server.

The honest assessment after looking at a lot of small government environments: most have a backup, and a meaningful share of them have one that would not have survived the event it exists for. It is worth finding that out on purpose.