A ransomware readiness assessment tests whether your organization can prevent, detect, contain and recover from an attack before one happens. You score your controls against a recognized framework, test your backups by restoring from them, and turn the gaps into a ranked fix list with owners and deadlines. This guide covers the frameworks worth using, what to examine, a checklist, how to test backups and how to read the results.
TL;DR
- A readiness assessment measures prevention, detection, response and recovery together. Passing one area while failing another still leaves you exposed.
- Free frameworks exist: CISA's Ransomware Readiness Assessment, NIST's ransomware community profile and, for banks, the R-SAT.
- The most important evidence is a documented, timed restore from backups that attackers cannot reach.
- Findings only matter when they become a prioritized roadmap with named owners and dates.
- Repeat the assessment after major changes and at least once a year.
Table of Contents
- What a ransomware readiness assessment measures
- Which framework to use
- Before you score anything: know what you have
- A ransomware preparedness checklist
- Testing your backup strategy
- How to assess ransomware risk and rank the gaps
- What a ransomware risk assessment report should contain
- Turning findings into a roadmap
- What to do if an attack happens before you finish
- Our perspective
- Getting help with the assessment
- FAQ
- Sources
What a ransomware readiness assessment measures
CISA's Ransomware Readiness Assessment (RRA) is a self-assessment built on tiered practices that helps organizations judge how well equipped they are to defend against and recover from ransomware. It ships as a module in CISA's Cyber Security Evaluation Tool (CSET) and produces a dashboard with summary and detailed results.
A readiness assessment is not the same as a vulnerability scan. A scan lists weaknesses on systems. A readiness assessment asks a broader question: if an attacker got in on Tuesday, how far could they travel, how fast would you notice, and how quickly could you run the business again?
In practice, assessments cover six overlapping domains:
- Access and authentication: multi-factor authentication, least-privilege accounts, administrator separation.
- Backups: segregation, immutability, offline copies and tested restoration.
- Endpoint and network defenses: detection tooling, segmentation, monitoring for lateral movement.
- Vulnerability and patch management: especially remote-access systems and internet-facing services.
- Incident response: a written plan, tabletop exercises, out-of-band communication.
- Governance: who owns ransomware risk, and whether leadership sees it.
This list follows the way published ransomware assessment frameworks group their questions.
Which framework to use
Pick one framework and use it consistently, so this year's score can be compared with next year's. Three are worth knowing.
| Framework | Best for | What you get |
|---|---|---|
| CISA Ransomware Readiness Assessment (in CSET) | Organizations formalizing their ransomware defenses | Tiered practices, IT and OT coverage, results dashboard |
| NIST IR 8374 Rev. 1 community profile | Teams that already use the NIST Cybersecurity Framework | Current and target profiles across all six CSF 2.0 functions |
| R-SAT 2.0 | Financial institutions | Board-level view of preparedness |
CISA's RRA
The RRA is a desktop self-assessment, free to use. It evaluates IT and OT security practices against ransomware and suits organizations at an early stage of maturity. Note that CISA confirmed on September 1, 2026 that its regional field staff would stop conducting RRAs, which had included guided sessions and tailored reports. The self-assessment itself is a tool you can still run on your own, but if you relied on a CISA adviser to walk you through it, you now need an internal owner or an outside team to do that job.
NIST's ransomware community profile
In June 2026 NIST published Interagency Report 8374 Revision 1, Ransomware Risk Management: A Cybersecurity Framework 2.0 Community Profile. It maps ransomware-relevant outcomes onto the CSF 2.0 functions: Govern, Identify, Protect, Detect, Respond and Recover. You document your current profile, set a target profile, and the difference between the two is your gap list. This approach works well when you need to show an auditor, insurer or board a structured method.
R-SAT for financial institutions
The Ransomware Self-Assessment Tool 2.0 was developed in October 2023 by the Bankers Electronic Crimes Taskforce, state bank regulators and the U.S. Secret Service. It gives executive management and the board an overview of how prepared an institution is to identify, protect, detect, respond and recover.
Before you score anything: know what you have
An assessment is only as good as your picture of your own environment. NIST's ransomware guide for getting started with risk management lists foundations to put in place first:
- Hardware and software inventories
- Documented information flows
- A list of external systems your network connects to
- The critical business processes and assets that cannot go down
- Tested, updated detection processes
- Trained staff
Spend the first week on this. Most surprises in an assessment come from systems nobody remembered: an old file server, a vendor's remote-access account, a cloud tenant set up by a former employee.
A ransomware preparedness checklist
CISA's #StopRansomware Guide organizes best practice into preparation, prevention and mitigation, plus a response checklist. Use the grouping below as a working checklist. Mark each line as verified, partly in place or missing, and attach evidence to every "verified".
Prevent
- MFA enforced on email, remote access, VPN and every administrator account
- Administrator accounts separate from daily-use accounts
- Critical patches applied on a defined schedule, with internet-facing systems first (see our patch management policy guide)
- Vulnerabilities ranked by real-world exploitation, not score alone (why KEV beats CVSS alone)
- Network segmentation so one compromised laptop cannot reach every server
Detect
- Logs collected centrally and retained
- Monitoring for behaviour, not only known malware signatures
- Alerts watched around the clock, or by a provider who does
- Awareness of the tell-tale signs CISA lists in its ransomware victim guidance: legitimate admin tools such as PowerShell or vssadmin used maliciously, new accounts appearing, and unexpected remote monitoring and management software
Respond
- A written incident response plan with named roles and after-hours contacts
- Out-of-band communication ready, because email may be down or watched
- Pre-agreed contacts for legal counsel, your insurer and federal law enforcement
- A tabletop exercise in the last 12 months (our tabletop guide shows how to run one)
Recover
- Multiple backups, encrypted, with at least one offline or immutable copy
- A restore procedure written down and tested
- A ranked list of which systems come back first
- Recovery time and recovery point objectives that leadership has approved
Testing your backup strategy
Backups are where ransomware assessments most often reveal a gap, because a backup that exists is not the same as a backup that restores. CISA's guidance is to maintain multiple offline, encrypted backups in more than one location and test recovery procedures regularly.
Attackers know backups are the thing that lets you refuse to pay. They look for backup consoles, delete snapshots and encrypt network shares first. So assess these points:
- Reach: Can a stolen domain administrator password delete or alter your backups? It should not. Backup administration and credentials should be separate from production.
- Immutability: Is at least one copy write-once, air-gapped or offline? Our 3-2-1 backup rule guide explains how to add an offline copy to the classic three-copy approach.
- Coverage: Do backups include identity systems, cloud tenants, SaaS data and configuration, not just file servers?
- Restore time: When did you last restore a full critical system, and how long did it take against your target?
- Order: Do you know which systems come back first? Prioritize those tied to health and safety, revenue and other critical services.
Record the date, the system, the elapsed time and who ran the test. That record is the evidence an insurer or auditor will ask for.
A worked example
Imagine a 60-person medical billing office with a file server, a cloud accounting system and a nightly backup to a NAS on the same network. On paper, backups are green. In the assessment, the team finds the NAS shares the domain's admin credentials and no one has restored from it in two years. Result: recovery marked "missing" despite the nightly job. The fix list becomes: add an immutable cloud copy, move backup credentials out of the domain, run a timed restore of the billing system, and document it. None of that required a new product category, only a test that asked the right question.
How to assess ransomware risk and rank the gaps
Once the checklist is scored, rank gaps by business consequence. A simple model combines two questions:
- Likelihood: How exposed are you, based on internet-facing systems, known vulnerabilities and weak authentication?
- Impact: How badly would the loss of this system disrupt critical services?
A missing MFA control on remote access to your billing system is high on both. A missing log on a rarely used test server is not. If you use the NIST profile, the target profile sets the destination and the ranking sets the route.
As a former head of CISA's Cybersecurity Division put it, as reported by TechTimes, a baseline assessment tells you where you stand, while goals tell you where to focus. You need both: skipping the baseline is like choosing treatment before a diagnosis.
What a ransomware risk assessment report should contain
The report is the deliverable your leadership, insurer and auditors will read. A useful one includes:
- Executive summary: overall readiness in plain language, the top three risks and the decisions needed.
- Scope and method: which systems, which framework, who took part, and the dates.
- Scored findings by domain: each control marked verified, partly in place or missing, with the evidence behind it.
- Business impact: which critical processes each gap threatens and the recovery objectives involved.
- Prioritized remediation roadmap: actions with owners, deadlines and expected effort.
- Residual risk: what remains after the roadmap is done, so leadership accepts it knowingly.
- Retest plan: when and how you will prove the fixes worked.
Separate what was verified from what was assumed. A control someone says is in place but nobody tested belongs in the "unverified" column.
Turning findings into a roadmap
A list of 40 findings paralyses a small team. Group them into three waves:
- First 30 days: quick, high-impact fixes such as MFA on remote access and administrators, removing backup credentials from the domain, and applying overdue critical patches.
- Next 90 days: an immutable backup copy, a timed restore test, segmentation of critical systems and a written response plan.
- Within the year: a tabletop exercise, monitoring improvements, vendor access review and board reporting.
Track a few measures that show real improvement: how fast alerts are triaged, how long a restore takes against its objective, and what share of critical systems have a verified recovery test. Reassess after any major change, such as a cloud migration, an acquisition or a new remote-access tool, and in any case yearly.
What to do if an attack happens before you finish
The immediate first step is to isolate affected systems: disconnect them from the network, or power them down if you cannot isolate them, to stop the spread. The Canadian Centre for Cyber Security's ransomware playbook sets this out, and CISA guidance aligns with it. After that, a good response checklist calls for notifying stakeholders and legal counsel, contacting federal law enforcement such as the FBI or Secret Service, switching to out-of-band communication and preserving forensic logs before restoration starts. The Georgia Department of Banking and Finance hosts a response checklist based on the R-SAT that covers these steps. For the first hour in detail, see our ransomware incident response guide and the enterprise incident response checklist.
Our perspective
Most readiness assessments we see fail in the same way: they score each control in isolation. Security is with one vendor, backups with another, cloud with a third, and compliance with a fourth. When the assessment ends, nobody owns the whole picture, and the gaps live in the handoffs between them.
That is why we built Nexus around consolidation. When detection, incident response, cloud management, backup and compliance sit under one provider and one SLA, a finding such as "backup credentials share the domain" is fixed by one accountable team rather than passed between three. Our approach is to pair 24/7 threat detection with tested recovery, so that readiness is something you can show, not something you assume.
If you are a small business with a limited budget, start with the checklist above and a single timed restore. If you are in healthcare or another regulated field, map your findings to the frameworks you answer to, such as HIPAA, and keep the evidence. Either way, an assessment should end with a short list, an owner for each item and a date.
Nick - Sr. Executive
Getting help with the assessment
If your team lacks time or a second pair of eyes, we can help. Nexus offers cybersecurity services that include 24/7 monitoring, incident response, vulnerability management and penetration testing, along with backup and disaster recovery, data protection and compliance assessments for frameworks such as HIPAA, SOC 2, PCI-DSS and ISO 27001. Pricing is fixed-fee under a monthly or project agreement. You can see how the pieces fit on our services page.
If compliance is your driver, our guide to a SOC 2 readiness assessment shows how a similar gap-and-evidence method works there, and our overview of ransomware protection strategies covers what to build once the gaps are known. Third-party access is a frequent weak point, so review the types of third-party cybersecurity risk alongside your own controls.
FAQ
How often should we run a ransomware readiness assessment?
Run a full assessment at least once a year, and again after major changes such as a cloud migration, merger or new remote-access arrangement. Run smaller checks, such as a restore test, more often, because backups drift as systems change.
Is there a free ransomware readiness assessment?
Yes. CISA's Ransomware Readiness Assessment is a free self-assessment inside its CSET desktop tool, and NIST's community profile is a free public document. CISA has said its regional staff no longer deliver guided RRAs, so you will run the self-assessment yourself or with an outside team.
What is the difference between a ransomware readiness assessment and a risk assessment?
The two overlap heavily. A readiness assessment focuses on whether your controls and recovery capability work against ransomware. A risk assessment adds likelihood and business impact scoring to rank which gaps matter most. A good project does both and ends in one roadmap.
What is the first thing to do when ransomware is discovered?
Isolate the affected systems by disconnecting them from the network, or powering them down if you cannot isolate them. Then follow your response plan: notify legal counsel and stakeholders, contact federal law enforcement and preserve logs before restoring anything.
Sources
- CISA's CSET Tool Sets Sights on Ransomware Threat
- NIST IR 8374 Rev. 1: Ransomware Risk Management, CSF 2.0 Community Profile
- Ransomware Self-Assessment Tool 2.0 (R-SAT)
- Ransomware assessment frameworks and requirements
- CISA cuts six free cyber assessments
- NIST: Getting Started with Cybersecurity Risk Management, Ransomware
- CISA #StopRansomware Guide
- CISA: I've Been Hit By Ransomware
- Ransomware Playbook (ITSM.00.099)
- Ransomware Self-Assessment Tool, Georgia Department of Banking and Finance