Ransomware Readiness Self-Check
Updated .
This self-check asks twelve yes-or-no questions across the five areas the briefing rotates through: backups, identity, email and payments, endpoints and patching, and vendors and response. It gives a score and, for every question you cannot answer with a clear yes, the guide to read next. It is a self-assessment, not an audit or a certification.
How it works
The scoring is deliberately simple, and shown in the result:
- Each Yes earns one point. No and Not sure earn none, because a control you cannot confirm is not one you can rely on.
- The score is the number of Yes answers out of 12.
- Once all twelve are answered, the page gives a reading: 11 or 12 is a strong baseline, 8 to 10 is some gaps, 7 or fewer is several gaps.
- Every question that is not a clear Yes is listed with the guide that explains the control.
What the questions cover. Three on backup and recovery, two on identity, two on email and payments, three on endpoints and patching, and two on vendors and response. They follow the controls that the CISA and Canadian Centre for Cyber Security ransomware guidance returns to repeatedly: backups an attacker cannot delete, multi-factor authentication, patching what is exposed, limiting privilege, and knowing in advance whom to call.
What it cannot tell you. A “yes” here is your own statement, not evidence. The bands are this page’s own rule of thumb and are not a standard, a legal test or an insurer’s criteria. Treat the result as a reading list, then confirm the important controls by testing them: restore a file, review the administrator list, look at the internet-facing devices. For an independent opinion, ask your IT provider for a written assessment or consult a qualified adviser.
Worked example
Suppose, as a hypothetical, a ten-person office answers Yes to the questions on multi-factor authentication, bank-detail call-backs, patching, local administrator rights and the vendor list, No to the immutable backup, the restore test, the recovery-time number and the printed plan, and Not sure to the leaver checklist, DMARC and the internet-facing list.
That is 5 Yes answers out of 12, which falls in the “several gaps” reading. The page then lists seven gaps, each with a link: immutable and offline backups, restore testing, recovery-time planning, the first-hour plan, the leaver checklist, SPF, DKIM and DMARC, and internet-facing exposure. The sensible order is to fix the backup copy and test a restore first, since those decide whether an attack is survivable. These answers are invented for illustration and describe no real business.
Frequently asked questions
Is this an audit or a certification?
No. It is a self-assessment built from your own answers. It cannot verify that a control exists or works, and it is not a standard, a legal test or an insurer’s underwriting criteria.
Why does Not sure count as No?
A control you cannot confirm cannot be relied on during an incident. Turning a Not sure into a confirmed Yes, or a clear No you can fix, is the useful outcome.
Where do the questions come from?
They follow the controls that national guidance on ransomware keeps returning to, such as the CISA #StopRansomware Guide and the Canadian Centre for Cyber Security’s baseline controls. They are a short list, not a full framework.
Should I aim for a perfect score?
A high score is a good sign but not a guarantee. What matters is that the controls are tested. Start with the gaps that decide whether you could recover: backups, multi-factor authentication on administrators and a printed response plan.
Does this send my answers anywhere?
No. The scoring runs in your browser and nothing is stored or sent.
Want the briefing in your inbox?
The briefing is published on this site every morning. The email edition is not sending yet — leave your address and you’ll be among the first told when it starts. Nothing is sent in the meantime.