The ransomware library is written: how attacks unfold, the first 72 hours, the immutable copy, the tabletop. This article is the mirror to hold up to all of it — a twelve-question self-audit answering the only question that matters in advance: if it happened tonight, would we actually recover? Score each question honestly — 2 for “yes, provably,” 1 for “partly / probably,” 0 for “no / don’t know” — and note that “don’t know” scores zero on purpose: in recovery readiness, unverified is unready.
The backup four
1. Does at least one backup copy survive an attacker who owns our network? Immutable or genuinely offline — unreachable even with stolen admin credentials, since destroying backups is step two of the playbook.
2. Is everything that matters actually covered? The coverage map reconciled against the inventory — servers, Microsoft 365, the SaaS platforms — because the system that isn’t backed up is the one the note will be about.
3. When did we last restore — with a stopwatch? A dated test log, including at least one restore from the immutable/offsite copy specifically. Job-status green scores zero here.
4. Do our restore times fit inside what the business can survive? The measured recovery times against the honest RTO/RPO numbers — a three-day restore against a one-day tolerance is a gap wearing a green checkmark.
The containment four
5. Would we know it was happening at 2 a.m.? EDR everywhere, with staffed 24/7 response behind it — because detonation is scheduled for your empty hours, and detection discovered Monday morning is question 3 doing all the work alone.
6. Is the blast radius pre-limited? Least privilege, no daily-driver admins, a segmented network — the controls that decide whether one infected laptop is the story or the first chapter.
7. Can we get in when the attacker changed the locks? The break-glass account, offline credentials, the identity-recovery plan — recovery’s recovery, tested.
8. Are the entry doors actually closed? No exposed remote access, MFA without exceptions, critical patches current — the exception list written and compensated, not silent. Readiness includes making the whole exercise less likely.
The response four
9. Can the plan be read when the servers can’t? The one-page IR plan and the runbook, printed and reachable from a phone in a parking lot — with the insurer’s breach hotline on it.
10. Do the humans know their first moves? Disconnect-don’t-power-off, hands off the backups, insurer before freelancing — rehearsed at least once in a tabletop, because first moves under adrenaline come from rehearsal or from panic.
11. Is the restore order written down? The runbook’s dependency-aware sequence, with credentials answered and validation defined — the difference between recovery as execution and recovery as improvisation.
12. Are the big decisions pre-owned? Who can order a shutdown knowing the downtime number, who speaks to clients per the communication plan, and the ransom posture agreed in advance with insurer and counsel in the loop.
Reading your score
20–24: genuinely ready — keep the testing rhythm that got you here, and re-audit annually. 13–19: the common profile — strong walls, soft spots in verification and rehearsal; your zeros and ones are next quarter’s prioritized list, and most convert to 2s in an afternoon each. Under 13: the honest reading is that recovery would currently be luck — start with questions 1, 3, and 9, in that order, because a surviving copy, a proven restore, and a reachable plan are the floor everything else stands on. Whatever the score, the audit’s real output is the same: a written list with owners, re-scored yearly, trending up — because ransomware readiness was never a feeling, and this page is what replaces the feeling with a number.
The bottom line
Twelve questions, scored without charity: backups that survive and provably restore in time, detection and blast-radius limits that contain the 2 a.m. version, and a response whose plans, people, and decisions have been rehearsed. Score it today, fix the zeros in priority order, re-score next year — and the night it stops being hypothetical, your answer to “can we recover?” will be the only acceptable kind: yes — we’ve checked.