Ransomware Readiness Assessment Checklist

A ransomware readiness assessment answers one question: if an attacker got a foothold in your environment today, would it be a contained incident or a business-ending one? The controls that decide the answer are remarkably consistent across real cases — which is good news, because it means readiness is measurable. This is a vendor-neutral checklist grouped into six domains you can score yourself against, with the specific failure each control is there to prevent.

1. Backups you have actually restored from

This is the control that most reliably changes the outcome. Modern ransomware operators hunt for backups and delete them before triggering encryption, so an online backup reachable with production credentials offers little protection against this threat. What you need: offline or immutable copies (object-lock, air-gapped, or a separate trust domain), and — the part most organisations skip — a documented, recently-executed restore test with a known recovery-time objective. A backup you have never restored from is a hope, not a control.

2. Segmentation that limits lateral movement

Most ransomware damage comes from lateral movement after the initial foothold — one compromised laptop becoming domain-wide encryption. Flat networks make that trivial. Segment by trust level, restrict east-west traffic, isolate backup infrastructure and domain controllers, and ensure workstations cannot freely reach each other. The test: from a standard user endpoint, how much of the environment is directly reachable?

3. Phishing-resistant identity

Ransomware still overwhelmingly begins with a phished credential or a token relayed through an adversary-in-the-middle kit. MFA on all remote and privileged access is table stakes; phishing-resistant MFA (FIDO2/passkeys) on those accounts removes the most-used entry path entirely. Pair it with least privilege so a single compromised account cannot reach crown-jewel systems.

4. Detection someone is actually watching

Endpoint detection and response (EDR) that alerts to no one is not detection. Readiness means EDR deployed on endpoints and servers, with coverage gaps known, and either an internal SOC or a managed service watching and empowered to act out-of-hours — because ransomware crews deliberately trigger on weekends and holidays.

5. A response plan you have rehearsed

The worst time to design your response is during the incident. A ransomware-specific plan names who declares the incident, who can authorise isolating production, where the offline restore runbook lives, how you communicate when email and identity are down, and when and how legal, insurer and law enforcement get involved. The test is a tabletop — walk it before an attacker does.

6. Least privilege and attack-surface hygiene

Exposed RDP, unpatched internet-facing services and over-privileged service accounts are the recurring initial-access and escalation paths. Reducing standing privilege, removing direct internet exposure of remote-access services, and keeping perimeter systems patched shrinks both the ways in and the blast radius once inside.

Score yourself, then close the biggest gap

Rate each of the six domains red/amber/green. The point is not the number — it is finding the one red domain that would decide your worst day, and fixing it first. For most organisations that is untested backups or flat networks.

How to run a ransomware readiness assessment, step by step

Run it as a short project: scope it, check it against a recognised baseline, collect evidence, score, test it with a tabletop, and turn the gaps into a plan with dates. A spreadsheet of yes/no answers alone is not an assessment.

1. Scope what would hurt most. List the services you cannot run without, and what they depend on: identity (Active Directory/Entra), backups, hypervisors and remote access. Ransomware goes after those shared dependencies first.
2. Pick a baseline so the result is defensible. Common choices are the CISA #StopRansomware Guide, NIST's ransomware profile of the Cybersecurity Framework (NIST IR 8374), and the free Ransomware Readiness Assessment (RRA) module in CISA's Cyber Security Evaluation Tool (CSET). The six domains above map onto all three.
3. Collect evidence, not opinions. Get the date and result of the last restore test, MFA coverage reports for remote and privileged access, the EDR deployment count against your asset inventory, and the firewall rules between segments. If nobody can produce the evidence, score the control as not in place.
4. Score each domain red, amber or green, and write down the failure each red item would allow.
5. Run a tabletop on a realistic scenario, such as encrypted servers on a Saturday with email down. It shows the gaps a checklist misses: who decides, who can isolate production, and where the restore runbook lives.
6. Turn gaps into a remediation plan with owners and dates, worst risk first, and re-assess after material changes or at least once a year.

Model the financial side with the Breach Cost calculator →, pressure-test your response in the ransomware simulation, and read how ransomware crews actually operate in our ransom-economy series.

Frequently asked questions

What is a ransomware readiness assessment? A structured review of your ability to prevent, detect, contain and recover from ransomware — walking the specific controls (backups, segmentation, identity, detection, response, privilege) and finding which are missing or untested.

What is the single most important control? Restore-tested offline/immutable backups — attackers destroy reachable backups before encrypting, so an online backup is not protection against this threat.

How often should we assess? At least annually and after any material change; the highest-value exercise is a full tabletop.

Does insurance replace readiness? No — insurers require these same controls, and weak ones raise premiums or void claims.