Why a Structured Ransomware Assessment Matters
Ransomware is not a new threat. What is new is how systematically attackers exploit gaps that organizations never bothered to measure. Most companies assume they are prepared because they have backups and antivirus. That assumption is how breaches happen.
A structured assessment forces you to evaluate your posture across the entire attack lifecycle — not just whether you can restore files, but whether you can prevent initial access, detect lateral movement, contain the blast radius, and recover operations under pressure. Without a structured approach, you end up with blind spots in exactly the places ransomware operators target.
The 20 questions below are organized into four phases: Prevent, Detect, Respond, and Recover. Each question maps to one or more CIS Controls so you can trace your readiness back to an established framework. If you already maintain a risk register, these questions will help you identify which risks need updated scoring or new mitigation tasks.
How This Assessment Is Organized
Each question includes context explaining why it matters and a CIS Control mapping so you can connect your answers to framework requirements. Answer each question honestly: Yes (fully implemented), Partial (started but incomplete), or No (not implemented). Partial answers count — they show you where to focus next.
This assessment pairs well with automated evidence collection because many of these controls generate artifacts that serve double duty for compliance audits.
Phase 1: Prevent (Questions 1-10)
Prevention is about reducing the attack surface before ransomware gets a foothold. These 10 questions cover the controls that stop most commodity ransomware campaigns.
Question 1: Do you maintain a current inventory of all hardware and software assets?
You cannot protect what you do not know exists. Shadow IT, unmanaged endpoints, and forgotten cloud instances are the entry points ransomware operators love. Asset inventory is the foundation of every other control on this list.
CIS Control mapping: CIS 1 (Inventory and Control of Enterprise Assets), CIS 2 (Inventory and Control of Software Assets)
Question 2: Are all operating systems and third-party applications patched within a defined SLA?
Unpatched vulnerabilities remain the most common initial access vector for ransomware. Your patch SLA should define timeframes based on severity — critical vulnerabilities patched within 72 hours, high within two weeks, and so on.
CIS Control mapping: CIS 7 (Continuous Vulnerability Management)
Question 3: Is multi-factor authentication enforced on all remote access, email, and privileged accounts?
MFA defeats the majority of credential-based attacks. If your VPN, email, cloud admin consoles, or RDP sessions allow single-factor authentication, you have an open door.
CIS Control mapping: CIS 6 (Access Control Management)
Question 4: Do you enforce the principle of least privilege across all user accounts?
Over-provisioned accounts mean a single compromised credential gives attackers broad access. Review whether users have only the permissions their role requires. Pay special attention to local admin rights on workstations.
CIS Control mapping: CIS 6 (Access Control Management)
Question 5: Are administrative accounts separate from daily-use accounts?
Domain admins should never browse the web or check email from their privileged account. Separate admin accounts with dedicated workstations (or at minimum, separate browser profiles) limit what attackers can do with a stolen credential.
CIS Control mapping: CIS 5 (Account Management), CIS 6 (Access Control Management)
Question 6: Is email filtering configured to block known malicious attachments and URLs?
Email is the delivery mechanism for most ransomware. Your email gateway should strip or quarantine executable attachments, scan URLs at time-of-click, and flag messages from newly registered domains.
CIS Control mapping: CIS 9 (Email and Web Browser Protections)
Question 7: Are endpoint detection and response (EDR) agents deployed on all endpoints?
Traditional antivirus is not enough. EDR provides behavioral detection, process-level visibility, and remote containment capabilities that matter during an active ransomware incident. Every endpoint — including servers — should have an agent.
CIS Control mapping: CIS 10 (Malware Defenses)
Question 8: Is network segmentation implemented to limit lateral movement?
Flat networks let ransomware spread from a single compromised workstation to every server in the environment. Segmentation — whether through VLANs, firewalls, or zero-trust network access — limits the blast radius.
CIS Control mapping: CIS 12 (Network Infrastructure Management)
Question 9: Are Remote Desktop Protocol (RDP) services disabled or restricted to VPN-only access?
Internet-exposed RDP is one of the most exploited entry points for ransomware. If RDP must be available, it should require VPN access, MFA, and network-level authentication at minimum.
CIS Control mapping: CIS 12 (Network Infrastructure Management), CIS 6 (Access Control Management)
Question 10: Do you conduct security awareness training that includes phishing simulations?
Users remain the first line of defense against phishing-delivered ransomware. Training should be ongoing, not annual, and include simulated phishing campaigns that measure click rates and report rates over time.
CIS Control mapping: CIS 14 (Security Awareness and Skills Training)
Phase 2: Detect (Questions 11-13)
Detection is about seeing ransomware activity before encryption begins. Most ransomware dwell times are measured in days — there is a window to catch it if you are watching.
Question 11: Do you monitor logs from endpoints, network devices, and identity systems in a centralized platform?
You cannot detect what you do not log. Centralized log management — whether a SIEM, XDR, or managed detection service — gives you the visibility to spot reconnaissance, credential harvesting, and lateral movement. Your vCISO tech stack should include centralized detection as a non-negotiable component.
CIS Control mapping: CIS 8 (Audit Log Management)
Question 12: Do you have alerting rules for known ransomware indicators and behaviors?
Logging without alerting is just storage. Your detection platform should have rules for volume shadow copy deletion, mass file renames, known ransomware process names, and anomalous encryption activity. These should fire alerts, not just write log entries.
CIS Control mapping: CIS 8 (Audit Log Management), CIS 10 (Malware Defenses)
Question 13: Is there a defined escalation path when a potential ransomware alert fires?
An alert that sits in a queue for 8 hours is the same as no alert. Your escalation path should define who gets notified, within what timeframe, and what authority they have to isolate systems before waiting for committee approval.
CIS Control mapping: CIS 17 (Incident Response Management)
Phase 3: Respond (Questions 14-16)
Response is about containing the damage and executing your plan under pressure. These questions test whether your incident response capability is real or theoretical.
Question 14: Do you have a written incident response plan that specifically addresses ransomware?
A generic incident response plan is better than nothing, but ransomware demands specific procedures: isolation decision trees, communication templates, law enforcement notification checklists, and ransom payment decision frameworks. The plan should be reviewed quarterly.
CIS Control mapping: CIS 17 (Incident Response Management)
Question 15: Have you conducted a tabletop exercise simulating a ransomware attack in the past 12 months?
A plan that has never been tested is a plan that will fail under pressure. Tabletop exercises reveal gaps in communication, decision authority, and technical procedures that only surface when people walk through the scenario together.
CIS Control mapping: CIS 17 (Incident Response Management)
Question 16: Do you have pre-established relationships with incident response counsel, forensic investigators, and law enforcement?
During a ransomware event, you do not have time to Google "incident response firm." Retainer agreements with IR counsel, forensic teams, and a known FBI or CISA contact should be established before you need them.
CIS Control mapping: CIS 17 (Incident Response Management)
Phase 4: Recover (Questions 17-20)
Recovery is about getting operations back. These questions determine whether your backup and recovery strategy will hold up when ransomware encrypts production systems.
Question 17: Are backups performed regularly and stored in a location that is isolated from the production network?
Backups that live on the same network as production systems get encrypted alongside them. Isolated backups — whether air-gapped, immutable cloud storage, or offline tape — are the difference between recovery and ransom payment.
CIS Control mapping: CIS 11 (Data Recovery)
Question 18: Have you tested a full restore from backup within the past 90 days?
Backups that have never been tested are not backups — they are assumptions. Test restores should include full system recovery, not just individual file recovery, and should measure recovery time against your business continuity requirements.
CIS Control mapping: CIS 11 (Data Recovery)
Question 19: Do you have documented recovery time objectives (RTO) and recovery point objectives (RPO) for critical systems?
RTO defines how long you can be down. RPO defines how much data loss is acceptable. If you have not defined these, you cannot evaluate whether your backup strategy is adequate or whether your business can survive a multi-day outage.
CIS Control mapping: CIS 11 (Data Recovery)
Question 20: Is there a communication plan for notifying customers, partners, and regulators during a ransomware event?
Ransomware is not just a technical event — it is a business event. Notification requirements vary by jurisdiction, industry, and contract terms. Your communication plan should include templates, approval chains, and regulatory timelines so you are not drafting press releases while systems are down.
CIS Control mapping: CIS 17 (Incident Response Management)
Scoring Your Assessment
Count your answers:
- Yes: The control is fully implemented and maintained
- Partial: The control exists but has gaps in coverage or consistency
- No: The control is not implemented
16-20 Yes answers: Strong ransomware posture. Focus on testing and continuous improvement.
11-15 Yes answers: Moderate posture with meaningful gaps. Prioritize the "No" answers in Prevent and Recover phases first.
6-10 Yes answers: Significant exposure. Consider engaging a vCISO or managed security provider to accelerate remediation.
0-5 Yes answers: Critical gaps across all phases. Immediate action required.
Turning Results Into Action
Running the assessment is step one. The value comes from turning each "No" and "Partial" into a tracked risk with an owner, a mitigation plan, and a deadline. This is exactly what a risk register is built for.
If you are a vCISO running this assessment for clients, the results also serve as evidence for cyber insurance applications. Carriers increasingly ask about specific ransomware controls — MFA, backup isolation, EDR coverage — and a completed assessment gives you documented answers.
BlueRadius works with organizations to turn assessment results into prioritized remediation roadmaps, connecting each gap to the CIS Control it violates and the compliance frameworks it affects.
Frequently Asked Questions
How often should I run a ransomware readiness assessment?
Run the full assessment quarterly. Between quarterly assessments, track individual controls through your GRC platform and update scores as controls are implemented or degraded.
Can this assessment replace a formal risk assessment?
No. This assessment focuses specifically on ransomware readiness. A formal risk assessment covers your entire threat landscape. However, the findings from this assessment should feed into your broader risk register.
What if my organization scores poorly?
A low score is not a failure — it is a baseline. The value is knowing where the gaps are so you can prioritize remediation. Focus on the Prevent and Recover phases first, as they have the highest impact on reducing ransomware risk.
Should I share assessment results with my board or executive team?
Yes. Translate the results into business language: "We are strong in prevention but have gaps in recovery that could extend downtime from hours to weeks." Executives need to understand the business impact, not the technical details.
How does a GRC platform help with ransomware readiness?
A GRC platform tracks each control as a risk with an owner, maps it to compliance frameworks, collects evidence of implementation, and alerts you when controls degrade. It turns a point-in-time assessment into continuous monitoring.
Want to try a quick version first? Take the free 10-question Ransomware Readiness Assessment — instant score, no signup required. Ready for the full 20-question version with tracked outcomes? Start your free trial of Radius360 and turn every gap into a managed risk with mitigation tasks, CIS Control mappings, and evidence collection. Need hands-on help? BlueRadius guides organizations through ransomware readiness programs from assessment to remediation.
