Security · Incident Readiness · 03
Ransomware readiness review
A ransomware readiness review assesses how well the organization would prevent, detect, contain and recover from a ransomware attack, against the controls that incident data and insurers consistently identify as decisive: credential protection, exposed services, endpoint detection, segmentation, backup isolation and restore capability. It is needed when an insurer asks ransomware-specific questions on an application or renewal, when leadership wants to know how long recovery would take, when a peer organization has been hit, or when backups have never been tested against an attacker who holds administrator credentials. The review produces a control-by-control readiness assessment with evidence, an estimate of recovery capability based on tested restores, the gaps ranked by their effect on the outcome, and a remediation sequence focused on what changes the result.
Scope
What the review covers.
- Initial access controls: email, exposed services, remote access, MFA
- Credential and privilege protection against lateral movement
- Endpoint detection, response and isolation capability
- Segmentation and containment of spread
- Backup immutability, isolation and tested restore
- Response readiness: plan, contacts, insurer notification, decision authority
Deliverables
What you receive.
| Deliverable | Form |
|---|---|
| Readiness assessment | Control by control, with evidence and rating |
| Recovery capability estimate | Based on tested restores and dependencies |
| Gap ranking | By effect on prevention, containment and recovery |
| Remediation sequence | What to change first and why |
Prerequisites
What we need from you.
- Access to identity, endpoint, network and backup systems or their administrators
- The insurance application or policy questions, if the review supports one
- The critical system list and recovery objectives, if defined
Related
Where this sits.
- Incident Readiness Service
- Security Hub
- Breach escalation procedures Also
- Evidence preservation workflows Also
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days
Questions
Asked before engaging.
Is this a penetration test?
No. It is an assessment of the controls that determine the outcome of a ransomware event. A penetration test may follow where the review identifies the need.
Can the result be used for an insurance application?
Yes. The assessment is structured to answer the questions insurers ask and to supply the evidence behind the answers.
What matters most?
In our experience, credential protection, isolated and tested backups, and the ability to isolate endpoints quickly. The review tests all three.