Ransomware Readiness Scorecard
Before an incident, not during one. Work through a checklist across the seven controls that actually decide whether an organisation survives ransomware — tested offline/immutable backups, identity and MFA, segmentation and EDR, external exposure, detection and a ransomware-specific IR plan, rehearsed governance and recovery capability. You get a banded 0–100 readiness score, a radar of where you are strong and weak, and the gaps ranked so you fix the ones that move survivability the most first. The weighting is a transparent heuristic, nothing is uploaded, and the score is shareable by permalink.
Core survival controls are missing. A single intrusion could become a full-estate encryption with no clean path to recover. Treat backups and identity as the first, non-negotiable fixes.
Score per dimension (0–100)
Prioritised gaps
Highest-weight, lowest-scoring controls first — spend remediation effort here.
- Backups & restore · unanswered
Establish at least three backup copies across two media types, with one copy held offsite.
Reference: CISA #StopRansomware
- Backups & restore · unanswered
Add an offline, air-gapped or immutable copy that cannot be reached or deleted with production credentials.
Reference: CISA #StopRansomware
- Backups & restore · unanswered
Run and document regular test restores. A green backup job is not a proven restore.
- Identity & access · unanswered
Enforce MFA, preferably phishing-resistant, on VPN, email and every remote-access path.
Reference: CISA #StopRansomware
- Identity & access · unanswered
Require strong MFA on all admin accounts, with no exemptions for service or break-glass accounts left standing.
- Segmentation & endpoint · unanswered
Segment the network so a single compromised host cannot reach everything. A flat network is the top enabler of mass encryption.
- Segmentation & endpoint · unanswered
Deploy EDR/XDR to all endpoints and servers and make sure someone is watching and triaging its alerts.
- External exposure · unanswered
Inventory everything internet-facing and remove or gate any exposed RDP/admin interface behind VPN + MFA.
Reference: CISA #StopRansomware
+ 22 more gaps in the full export.
Backups & restore · weight 20
The single control that most often decides whether you can refuse to pay. 3-2-1-1-0: three copies, two media, one offsite, one offline/immutable, zero errors on a TESTED restore.
Backups follow a 3-2-1 pattern: at least three copies, on two different media, with one copy kept offsite.
At least one backup copy is offline, air-gapped or immutable (WORM) — unreachable using production credentials.
Restores are actually tested on a schedule — not just backup jobs reporting success.
Recovery-time and recovery-point objectives (RTO/RPO) are defined for critical systems and validated against real restore times.
Backup infrastructure uses separate, MFA-protected credentials and alerts on mass deletion or job disablement.
Identity & access · weight 18
Most ransomware enters through an account, not an exploit. MFA everywhere, no shared admins, tiered admin identities, and vaulted privileged access.
MFA is enforced on all remote access, VPN and email — ideally phishing-resistant (FIDO2 / passkeys).
Every privileged / administrative account requires strong MFA.
There are no shared admin accounts — every privileged action is attributable to an individual.
Admin identities are tiered: day-to-day accounts do not hold domain / global admin, and admin accounts are not used for email or browsing.
Privileged access is time-bound or vaulted (PAM / just-in-time), not permanently standing.
Segmentation & endpoint · weight 15
A flat network turns one compromised host into the whole estate. Segmentation plus EDR/XDR is what limits the blast radius.
The network is segmented into zones; lateral movement between them is restricted and controlled, not a flat LAN.
EDR/XDR is deployed across endpoints and servers, with alerts actively monitored.
Lateral-movement protocols (RDP, SMBv1, admin shares) are disabled or tightly restricted internally.
Critical systems, domain controllers and backup infrastructure sit in isolated, hardened zones.
External exposure · weight 14
The ways attackers get in from outside: exposed remote access, unpatched edge appliances and email. Shrink and patch the attack surface.
The external attack surface is inventoried; there is no unmanaged RDP, VPN or admin interface exposed to the internet.
Internet-facing VPN concentrators and edge appliances are patched promptly when vendors issue advisories.
Email has filtering, attachment/link protection and an easy way for users to report phishing.
Vulnerability management prioritises known-exploited vulnerabilities (e.g. the CISA KEV catalog) for fast remediation.
Detection & response · weight 13
Seeing the intrusion before the encryption, and having a ransomware-specific plan for the hours after. Logging, monitoring and an IR plan that names ransomware.
Central logging / SIEM covers endpoints, identity and network, with retention long enough to investigate.
There is 24x7 monitoring or on-call coverage to triage alerts — ransomware often detonates out of hours.
A ransomware-specific incident-response plan exists (isolation, containment, decision and recovery steps), not just a generic IT-outage plan.
Early ransomware indicators are alerted on — mass file changes, shadow-copy / backup deletion, credential dumping, disabled security tooling.
Exercise & governance · weight 10
A plan nobody has rehearsed, with roles nobody has agreed, fails under pressure. Tabletop it, define authority, and line up legal/insurer/comms before the day.
A ransomware tabletop exercise is run at least annually, including leadership and the pay/no-pay decision.
Incident roles and decision authority are defined in advance — who declares, who approves spend, who speaks externally.
Legal counsel, the cyber-insurer and a comms/PR contact are identified and reachable before an incident, not found on the day.
An offline copy of the IR plan and the contact tree exists — reachable when the network, email and directory are down.
Recovery capability · weight 10
Having the backups is not the same as being able to rebuild. Runbooks, gold images, dependency order and a clean-rebuild strategy.
A documented restoration runbook exists and is kept current — the actual sequence to bring systems back.
Known-good gold images or rebuild automation exist for critical systems.
Application and service dependencies are mapped, so systems are recovered in a workable order.
There is a clean-rebuild strategy — recovery goes into a known-clean environment, not back into a still-compromised domain.
Heuristic self-assessment. The dimension weights are a transparent judgement framework for structured self-reflection, not a measurement, certification or guarantee of outcome. This tool references CISA #StopRansomware and the NIST Cybersecurity Framework by name only; it quotes no breach or cost figures, performs no scan, and runs entirely in your browser — nothing is uploaded. Your answers are stored only in the shareable link you choose to copy.
What this scorecard is
- A free, 100% in-browser PRE-incident self-assessment: answer a checklist across the seven control areas that actually decide whether an organisation survives a ransomware event, and get a banded 0–100 readiness score.
- Seven weighted dimensions: backups & restore, identity & access, segmentation & endpoint, external exposure, detection & response, exercise & governance, and recovery capability.
- Every question maps to a concrete next action, and the gaps are prioritised lowest-score, highest-weight first — so you spend remediation effort where it moves survivability the most.
- The weighting is a transparent HEURISTIC for structured self-reflection, not a measurement or certification. It references CISA #StopRansomware and NIST CSF by name only and quotes no invented breach or cost figures.
- Nothing is uploaded. Export to Markdown or CSV, and share the exact scorecard with a permalink (your answers are encoded in the link, base64url).
Survivability is decided before the ransom note
By the time the ransom note appears, the decisions that matter have already been made. Whether you can refuse to pay comes down to a small number of controls you either put in place in advance or did not: a backup copy the attacker could not reach and delete, MFA on the account they would otherwise have walked in through, a network that does not let one host become every host, and a plan your team has actually rehearsed. This scorecard turns those into a structured checklist so the gaps are visible while there is still time to close them.
The seven dimensions are weighted on purpose — backups and identity carry the most, because in published incident guidance they are the controls that most often decide the outcome. That weighting is a heuristic, shown openly so you can argue with it and adjust it to your own environment. The scorecard references well-known public guidance — CISA's #StopRansomware material and the Respond and Recover functions of the NIST Cybersecurity Framework — by name, as orientation. It is a self-assessment framework, not a certification, and it quotes no invented statistics.
Frequently asked questions
What does the Ransomware Readiness Scorecard measure?
It is a pre-incident self-assessment of the controls that most decide whether an organisation can survive a ransomware event without paying: tested offline/immutable backups, MFA and privileged-access hygiene, network segmentation and EDR coverage, external attack-surface and patching, detection and a ransomware-specific incident-response plan, rehearsed governance, and the ability to actually rebuild. You answer each item as in place, partial, or no, and the tool produces a weighted 0–100 readiness score with a band and a prioritised gap list.
Is the score a real measurement or a benchmark?
No. It is a transparent heuristic framework for structured self-reflection, not a measurement, benchmark, audit or certification, and it does not predict any outcome. The dimension weights (backups and identity carry the most) reflect widely published guidance on what tends to decide ransomware survivability, but they are deliberately shown so you can adjust them to your own risk model. The value is the structured conversation and the prioritised to-do list, not the exact number.
Does it scan anything or send my answers anywhere?
No. The scorecard runs entirely in your browser. It performs no scan and touches no system. Your answers are never uploaded — they live only in the shareable permalink you choose to copy (encoded in the URL) and in any Markdown or CSV file you export yourself.
What frameworks does it draw on?
It is organised around the control areas emphasised in public ransomware guidance — notably CISA's #StopRansomware guidance and the known-exploited-vulnerabilities (KEV) catalog, and the Respond/Recover functions of the NIST Cybersecurity Framework. It names these sources for orientation only and does not reproduce or quote figures from them; the question wording is PlayCISO's own plain-language paraphrase.
What is the 3-2-1-1-0 backup rule the tool keeps referring to?
It is a backup resilience target: three copies of the data, on two different media, with one copy offsite, one copy offline or immutable (so it cannot be reached and deleted with production credentials), and zero errors verified on a test restore. The last two are what ransomware readiness turns on — attackers routinely delete reachable backups, and a backup job that reports success is not the same as a restore you have actually proven works.