// micro-tool

Ransomware Readiness Assessment

Score your organisation against the controls that most reduce ransomware impact (CISA #StopRansomware / NIST CSF aligned) and get a prioritised gap list plus a residual blast-radius estimate. Answers are scored in-memory only and are never stored or logged.

Are backups isolated/immutable and restoration tested in the last 90 days? (weight 20)

Immutable + tested Offline copy, untested Online only No reliable backups

Is phishing-resistant MFA enforced for email, VPN, and admin access? (weight 16)

Everywhere (FIDO2/passkeys) MFA but push/SMS Partial None

Is EDR/XDR deployed and actively monitored across endpoints and servers? (weight 14)

Full coverage, 24/7 monitored Deployed, business-hours Partial None

Is the network segmented to limit lateral movement (e.g. flat vs. tiered)? (weight 12)

Strong segmentation + admin tiering Some VLAN separation Mostly flat Flat network

How quickly are critical/internet-facing vulnerabilities patched? (weight 12)

KEV within days, scanned Within ~30 days Ad-hoc Rarely

Are admin rights minimised (no daily-driver local admin, separate admin accounts)? (weight 10)

Least privilege + PAM Some controls Many local admins Users are admins

Is there a written, rehearsed incident-response & ransomware playbook? (weight 10)

Tested in last 12 months Documented, untested Informal None

Are inbound email controls in place (DMARC enforce, attachment sandboxing)? (weight 6)

DMARC p=reject + sandboxing Some filtering Basic spam only None

← All tools