Ransomware Resilience Check: How Ready Is Your Organization?

Ransomware readiness is measured not by how many controls you have, but by which of them still work on the day of an attack. This ransomware readiness assessment weights 11 controls across backup, access security, detection and response, produces a resilience score from 0 to 100, and ranks your gaps by importance. The ransomware resilience check is based on the recommendations in CISA’s #StopRansomware Guide and the functions of the NIST Cybersecurity Framework.

Answer each question Yes, Partly or No. Your answers stay in your browser and are never sent to a server.

How is the score calculated?

Each answer becomes a factor: Yes 1, Partly 0.5, No 0. The factor is multiplied by the control’s weight, divided by the total weight of 25 and converted to a score out of 100.

Weights reflect how much each control decides whether you can recover after an attack. The controls are drawn from CISA’s #StopRansomware Guide:

Control	Weight
At least one backup copy is immutable or offline	3
Restores are tested regularly	3
MFA on remote access, email and admin accounts	3
RDP and management interfaces are not directly exposed to the internet	3
Security updates applied regularly, especially on internet-facing systems	2
Behavior-based endpoint protection (EDR/XDR)	2
Network segmentation, including a separate backup network	2
Separate admin accounts; backup system uses separate credentials	2
24/7 monitoring of security events	2
Written and rehearsed incident response plan	2
Email filtering and awareness training	1

The result screen lists your gaps by weight, each with a short recommendation and a link to the related service.

What do the score bands mean?

Below 50 is shown as low, 50 to 79 as medium, and 80 or above as high resilience. The band does not predict whether an attack will happen; it indicates how quickly and cleanly operations can recover afterwards.

Take an example where only the immutable backup and MFA questions are Yes, restore testing is Partly and everything else is No. The math is (3 + 3 + 1.5) / 25 = 0.30, a score of 30 in the low band. Two strong controls are not enough while the layers that limit initial access and lateral movement are missing.

A high band shows that the controls exist on paper. Proving that they actually work takes the verification steps below.

What each control proves, and how to verify it

Answering Yes to a control should rest on evidence someone can see. If there is no evidence, or it covers only some systems, the honest answer is Partly.

Recovery: backups and restores

An immutable or offline backup proves that an attacker with admin rights still cannot delete the last clean copy. To verify it, show that a retention lock period is set in the backup software and that an administrator cannot delete a copy before that period ends. Our immutable backup storage page explains how this works in practice.

A restore test proves that the backup actually opens, and how long it takes. Look for a dated test record, the name of the restored system and the measured duration. If only file-level restores have been tested and never a full server, answer Partly.

Access: MFA, RDP and privileges

The MFA control proves that a stolen password alone is not enough to get in. The identity provider report should show no accounts without MFA enrolment, with any exceptions backed by a written reason. If even one of VPN, email or admin accounts is left out, the answer is Partly.

Verify that RDP and management interfaces are closed to the internet with an external port scan; a firewall rule on its own is not proof. For privileges, show that daily work is not done with admin accounts and that domain accounts cannot sign in to the backup system.

Prevention and detection: patching, EDR, segmentation, monitoring

For patching, the evidence is a current inventory showing the patch level of internet-facing systems. For EDR, compare the agent count in the management console with your server and PC inventory; the difference shows unprotected devices.

Segmentation is verified when a PC on the user network cannot reach the backup server. For 24/7 monitoring, records should show who handled an out-of-hours alert and how quickly.

Preparedness: response plan and email

The evidence for an incident response plan is a written document with current roles and contact details, plus the date of the last exercise. For email, show that filtering rules are active and that training was repeated within the last year.

In what order should gaps be closed?

Start with the controls that make recovery possible, then close the attacker’s entry points. The weight order on the result screen follows this logic.

If immutable backups and restore testing are missing, getting data back is left to chance even if every other defense fails. These two items are the precondition for returning to work without paying a ransom. Enforcing MFA and taking RDP off the internet then narrow the most common entry paths quickly and at low cost.

When choosing between items of equal weight, consider how long each takes. Separating admin accounts can be done in days, while network segmentation needs planning.

For a full ransomware checklist explanation, general protection methods and attack types, see our ransomware protection guide. This page focuses on measuring where those measures stand today.

When should you answer “Partly”?

Answer Partly when a control exists but does not cover its full scope, or when its evidence is incomplete. When in doubt, choosing Partly instead of Yes keeps the score from overstating reality.

Typical cases: MFA is on for email but not for VPN; backups are immutable but some servers are outside backup scope; the incident response plan is written but has never been exercised.

How to confirm the result with exercises

Confirm the self-assessment score with two kinds of exercise: a tabletop scenario and a real restore drill. CISA’s guide also recommends exercising the incident response plan regularly.

In a tabletop exercise, the relevant teams walk through a ransomware scenario step by step: who decides, which systems are isolated, and when management and customers are informed. Gaps found during the exercise go back into the plan.

In a restore drill, a critical system is brought up from backup in an isolated environment and the time is measured. Compare that time with the downtime the business can accept. The difference is the most concrete measure of your ransomware preparedness.

Scope and limits of the check

This tool is a self-assessment; it does not replace a penetration test, vulnerability scan or audit. The accuracy of the result depends on how well the person answering knows the infrastructure.

The controls were chosen to span the identify, protect, detect, respond and recover functions of the NIST Cybersecurity Framework. Repeating the check every six months, or after a major infrastructure change, lets you track how the score moves over time.

Backup, monitoring and response at MAV Cloud

MAV Cloud’s backup service is Veeam-based, with backup storage located in Türkiye. A gap in the immutable backup control can be addressed on this platform. Security event monitoring is covered by our SOC service.

During an incident, you need to know in advance how soon first response begins. MAV Cloud’s service level agreement sets a monthly 99.9% availability target for backup services, with first-response targets of 15 minutes for critical, 1 hour for high, 4 hours for medium and 1 business day for low priority.

Information security and business continuity management are part of resilience too. MAV Cloud is certified to ISO/IEC 27001, ISO/IEC 27701, ISO 22301, ISO/IEC 20000 and ISO 9001 (see our certifications).

Frequently Asked Questions

How long does the ransomware readiness assessment take?

There are 11 questions, and a few minutes is enough for someone who knows the infrastructure.

Does a score above 80 mean full protection?

No. A high score shows that the core controls are in place and that the chance of recovering after an attack is high. No set of controls reduces risk to zero.

Why do the backup questions carry the most weight?

Backup is the only layer that brings data back once every other defense has failed. An immutable copy and a tested restore process are the precondition for returning to work without paying a ransom.

How often should the check be repeated?

Every six months, or after changes such as a new remote access method, a new branch or a major system migration.

What is the difference between Partly and No?

Partly means the control exists but does not cover its full scope or lacks evidence, and earns half credit. No means the control is not in place at all.

Are my answers stored anywhere?

No. The score is calculated in your browser and your answers are not sent to a server.

If your score is low, starting with the two highest-weighted gaps makes the biggest difference fastest. If it is high, the next step is to confirm it with a restore drill.