Ransomware Readiness.
Ransomware is not a malware problem; it is a business-continuity problem. We measure whether you could actually recover, then close the gaps that turn an incident into a shutdown.
Overview
This engagement evaluates your environment against the controls that most determine a ransomware outcome, mapped to NIST CSF and CISA guidance. The centerpiece is a recovery validation: we confirm that backups exist, are isolated from the production domain, and can actually be restored within a time the business can survive. We pair that with identity, email, endpoint, and segmentation review, and finish with a tabletop so leadership has made the hard decisions before a real event.
What's included
- Backup and recovery validation: isolation, immutability, and a real restore test
- Identity hardening review: MFA coverage, privileged access, and account-takeover resistance
- Email and endpoint controls against the common initial-access paths
- Network segmentation and blast-radius analysis
- Recovery-time and recovery-point objective (RTO / RPO) reality check
- Ransomware-specific incident response runbook
- Executive tabletop exercise on a ransomware scenario
Why it matters
- Recovery is the control that counts. Most victims who pay do so because their backups failed or were encrypted too.
- Identity is the front door. Stolen or unprotected credentials drive most ransomware entry.
- Blast radius is a choice. Flat networks turn one host into the whole estate.
- Decisions belong before the incident. A rehearsed runbook saves the hours that matter most.
What you get
- Readiness report. Scored against NIST CSF and CISA guidance, with a prioritized gap list.
- Recovery findings. Whether you can restore, how long it takes, and what would block it.
- Response runbook. A ransomware-specific playbook with roles, decisions, and contacts.
- Tabletop after-action. Decisions made, gaps surfaced, and owners assigned.
Common questions
How is this different from a risk assessment?
A risk assessment is broad. This is focused specifically on the controls that decide a ransomware outcome, with a hands-on recovery validation rather than a checklist review.
Do you actually test our backups?
Yes. A documented backup is not a recovery. We validate isolation and immutability and run or observe a real restore so you know your recovery time before an attacker sets it for you.
Can this support a cyber-insurance application?
Yes. The findings map directly to the controls insurers ask about (MFA, privileged access, tested backups, segmentation), and the report is suitable as supporting evidence.