The threat of cyber-attack is at an all-time high for businesses. The frequency of cyber-attacks continues to increase, both at the state and non-state level, while the nature of the attacks are becoming more intelligent and advanced, aided by the support of AI. Cyber-attacks can take many forms, for example phishing, password attacks, denial of service and, particularly common in recent years, ransomware attacks. Ransomware is a type of malware which prevents a business from accessing systems and data, usually by encrypting the files, resulting in the attacker demanding a ransom in exchange for decryption. While we are seeing increasing activity from legislators, regulators and law enforcement authorities globally to tackle the increasing risk of cyber threat, the first defence a business has is itself. This article explores some of the ways in which businesses can prepare for the threat of a cyber-attack, focusing on organisational measures a business can implement. However, we do not detail the kinds of technical security measures businesses could maintain in this respect.