Ransomware Readiness & Self-Assessment Tool
A ransomware self-assessment tool that scores your readiness across Prevent, Detect, Respond and Recover — so you can see, in five minutes, exactly where an attack would hurt most.
Score your resilience across the four ransomware phases — Prevent, Detect, Respond, Recover — in about 4 minutes. Weak recovery is where most organisations actually fail; this shows you where you'd break.
Aligned to CISA #StopRansomware. Then live the scenario: run a ransomware incident in the Cyber War Room.
Phishing and initial-access defenses (email filtering, MFA, patching)?
Loading…
Sample report · illustrative data
Sample result: ransomware readiness
Eight questions were answered, two each for Prevent, Detect, Respond and Recover, each scored 0 to 3.
Overall
- Overall readiness
- 42% · Red
- Answered
- 8/8
- Weakest area
- Recover (17%)
- Rating bands
- Green 80% and above, Amber 50% to 79%, Red below 50%
Per-phase result
| Phase | Points | Score | Rating |
|---|---|---|---|
| Prevent | 4 of 6 | 67% | Amber |
| Detect | 3 of 6 | 50% | Amber |
| Respond | 2 of 6 | 33% | Red |
| Recover | 1 of 6 | 17% | Red |
What the answers point to (example)
- Recover: backups are online and a full restore has never been tested, so the recovery time is unknown.
- Respond: only a generic incident response plan exists, and the ransom-payment decision has not been made in advance.
- Detect: endpoint detection covers some systems; mass encryption or exfiltration might be noticed only after the fact.
Made-up example data. Your own run uses your inputs. Downloads of the full report need Pro.
What this ransomware self-assessment checks
Eight questions, two for each phase of a ransomware attack, each scored 0–3, with a Red/Amber/Green result per phase. The questions follow CISA #StopRansomware guidance. The top answer in each phase looks like this:
- Prevent: phishing-resistant MFA, rapid patching of internet-facing systems and hardened RDP/VPN; lateral movement limited by micro-segmentation, PAM or just-in-time admin, and tiered accounts.
- Detect: EDR/XDR with behavioural detection and 24/7 monitoring for precursors; canaries, exfiltration detection and volume-anomaly alerts so mass encryption or data theft is noticed while it is happening.
- Respond: a ransomware-specific playbook tested live, with legal, communications and executives integrated; a board-approved position on ransom payment, including sanctions checks.
- Recover: immutable and offline backups on separate credentials (3-2-1), and a full end-to-end recovery test that validates RTO and RPO for critical services.
Recovery is where most organisations fall short: a backup that sits online, or that has never been restored, does not protect you against ransomware. This is an indicative self-check, not an audit. For a weighted score across seven control areas, use the Ransomware Readiness Scorecard. For the control-by-control evidence an assessor will ask for, work through the ransomware readiness assessment checklist. New to the topic? Start with What is ransomware?, and see the business continuity plan guide for recovery targets. Healthcare organisations can check the HIPAA penalty tiers that apply after an incident.
Frequently asked questions
Is there a ransomware self-assessment tool?
Yes — this is a ransomware self-assessment tool. You answer questions across Prevent, Detect, Respond and Recover and get per-phase Red/Amber/Green scores in your browser, so you can see where your ransomware readiness is strong and where it is weak.
What is the ransomware assessment aligned to?
CISA #StopRansomware guidance, so the questions reflect the controls U.S. authorities recommend to prevent, contain and recover from ransomware.
How long does the ransomware readiness test take?
About five minutes. It is a self-assessment you can run on your own or with your team, and nothing is stored server-side.
What does the ransomware readiness assessment cover?
Four phases: Prevent (hardening, MFA, patching, backups), Detect (monitoring and alerting), Respond (incident response and containment) and Recover (tested restores and continuity). Each phase gets its own Red/Amber/Green score so you can prioritise the weakest.
Related free assessments
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.