Organizations often evaluate ransomware readiness by testing backup restoration and monitoring deployment coverage. This single-layer approach misses critical gaps: whether recovery systems remain viable when attackers target them, whether detection and containment can interrupt an intrusion before encryption deploys, and whether extortion response can operate independently of recovery success.
CISA's Ransomware Guide recommends organizations evaluate readiness across detection capability, backup integrity, recovery procedures, and business continuity planning — establishing that readiness is a multi-domain assessment, not a single-control evaluation. This article organizes that multi-domain assessment into three layers — resilience, speed, and economics — as a practical framework for identifying capability gaps. The three-layer structure is not a complete readiness standard, and no framework eliminates ransomware risk. Capabilities reduce risk under tested conditions; they do not guarantee outcomes.
What this evaluation covers
This evaluation tests organizational capability across three ransomware control layers: resilience, speed, and economics. Each layer addresses different failure modes and requires distinct evaluation criteria. Organizations should assess capability gaps before selecting platforms or technologies — readiness evaluation identifies what needs to be built, not what products to buy.
The evaluation uses nine criteria across the three layers to identify where organizational response can fail under ransomware pressure. Unlike assessments that measure only control presence, this evaluation tests whether controls can function when attackers actively work to disable them.
The three readiness layers
Resilience layer: Tests whether recovery systems and procedures can function when attackers target backup infrastructure, identity systems, and recovery dependencies. Gaps at this layer mean that backup existence does not guarantee recovery capability when ransomware operators actively work to prevent restoration.
Speed layer: Evaluates whether detection and containment can interrupt attacker activity before encryption deploys. Dwell time — the period from compromise to detection — varies significantly: M-Trends 2024 reported a five-day ransomware median based on 2023 investigations, but individual intrusions range from hours to months. Effective evaluation tests rapid and extended intrusion scenarios, including extortion-only cases where encryption never occurs. Speed layer failures result in organizations discovering attacks only after encryption triggers, when containment options are limited and recovery becomes the primary response path.
Economics layer: Assesses whether the organization can respond to extortion that operates independently of the encryption track — data publication threats that persist regardless of backup restoration success. Economics layer gaps leave organizations unable to address the leverage that drives ransom demands even when technical recovery succeeds.
Evaluation criteria by layer
| Layer | Criterion | What good looks like | Red flag | How to test |
|---|---|---|---|---|
| Resilience | Recovery dependency mapping | Organization has mapped which systems, vendors, and services are on the critical path to recovery | Recovery procedures assume external services remain available | Document every system required for each recovery procedure; identify single points of failure |
| Resilience | Tested recovery procedures | Technical restoration tests demonstrate clean recovery of critical business services, including data integrity, recovery time, and acceptable data loss; tabletop exercises assess coordination and decisions under degraded conditions | Recovery tests only verify that backup data restores without validating dependencies, integrity, or recovery metrics | Run isolated restoration tests with defined success criteria; run separate exercises where primary recovery systems are marked compromised or unavailable |
| Resilience | Identity recovery readiness | Organization can restore operations when identity infrastructure is unavailable or compromised; emergency access mechanisms are independently protected, monitored, and regularly tested | Recovery procedures depend on existing identity systems functioning normally; alternative authentication addresses outage only, not trust restoration after compromise | Test recovery with identity systems offline; verify emergency access accounts are protected independently and exercised separately from standard authentication; validate procedures for restoring trust in compromised identities and administrative access |
| Speed | Pre-encryption detection | Controlled scenarios with defined expected behaviors and telemetry coverage establish that detection identifies lateral movement, privilege escalation, and anomalous data access; findings include analyst recognition time and actionable outcomes | Detection evaluation relies on rule review and alert volume without validating whether analysts recognize and act on attacker behavior | Run scenarios with defined behavioral sequences; measure time from alert generation through triage, authorization, containment execution, and verification that attacker access has been interrupted |
| Speed | Containment response time | Organization has defined and tested containment procedures with measured execution time from initial alert through verified interruption of attacker access | Containment procedures require extended analysis or approval chains that cannot execute within documented intrusion timelines | Time the full containment cycle; identify decision bottlenecks; distinguish authorization paths for rapid technical containment from those required for ransom decisions |
| Speed | Recovery window awareness | Leadership understands how intrusion duration and attacker targeting of recovery systems affect recovery option viability | Leadership assumes recovery is always possible if backups exist | Present scenarios spanning rapid and extended intrusions, including cases where dwell time compromises backup integrity or recovery systems |
| Economics | Exfiltration exposure mapping | Organization has assessed what data is accessible to attackers and what extortion leverage it creates, independent of encryption | Data classification focuses on compliance requirements rather than extortion value | Map data access paths; assess which data types create extortion pressure independent of encryption recovery |
| Economics | Extortion decision rights | Decision authority for ransom response is pre-defined, with reachable decision makers, authorized alternates, clear escalation paths, and tested decision timeframes that meet required governance | Ransom decision authority is undefined, untested, or no alternates exist when primary decision makers are unavailable | Document who can authorize extortion response and under what conditions; test decision chain during simulated pressure scenarios; verify escalation paths and alternates |
| Economics | Double extortion readiness | Response plan addresses data publication threats independently of encryption recovery | Response plan assumes encryption recovery resolves the incident | Simulate scenarios where backup restoration succeeds but publication threats continue |
Recovery dependency mapping: Most organizations can list their backup systems but cannot identify every external dependency required for recovery execution. Map each step in recovery procedures against external services — backup administration, identity, cryptographic keys, network services, and vendor access — and check for attacker persistence in recovered environments. Attackers often target these dependencies to prevent recovery even when backups remain intact.
Pre-encryption detection: Ransomware operators typically maintain access before deploying encryption, though the duration varies widely. Evaluate detection by running controlled scenarios with defined expected behaviors and measuring the full sequence: alert generation, analyst triage, authorization, containment execution, and verification that attacker access has been interrupted. Rule review and alert volume alone do not establish whether detection is effective.
Exfiltration exposure mapping: Double extortion tactics use data publication threats that persist regardless of backup restoration success. Assess which data creates extortion leverage by mapping what attackers can access, not just what compliance frameworks classify as sensitive.
Questions to ask
Resilience questions: Can recovery procedures execute if the primary identity provider is unavailable? Which vendor services must remain operational for backup restoration to succeed? How long can recovery procedures tolerate external service outages? If identity infrastructure is compromised rather than merely unavailable, what procedures restore trust in administrative access?
Speed questions: What attacker behaviors can security controls detect, and what telemetry gaps exist? How quickly can the full containment cycle execute — from alert generation through verified interruption of attacker access? Do containment procedures distinguish rapid technical authorization from governance required for ransom decisions?
Economics questions: Which data would create extortion pressure if published, regardless of encryption recovery? Who has authority to make ransom decisions when primary decision makers are unavailable, and have alternates and escalation paths been tested? How does the response plan address publication threats that continue after technical recovery?
Cross-layer integration: Test scenarios where failure in one layer increases pressure on others — detection failure compresses recovery timelines, while extortion leverage can drive decisions that bypass technical response entirely. Recognizing these interactions is more useful than assuming any single layer provides a complete answer.
Evidence to request
When evaluating vendor claims or internal program maturity, request documentation that demonstrates tested capability rather than control presence:
- Restoration test results that show recovery of critical business services with measured recovery time, data loss, and dependency availability — not just confirmation that backups exist
- Dependency diagrams that trace every external service, vendor, and system required for each recovery procedure, with identified single points of failure
- Measured detection and containment performance from controlled scenarios: telemetry coverage, analyst recognition time, authorization timelines, and verified interruption of simulated attacker access
- Exercise findings with corrective actions and named owners, distinguishing tabletop coordination results from technical recovery validation, with evidence that identified gaps were remediated
What good looks like
Organizations with mature ransomware readiness can execute recovery procedures under adversarial conditions, interrupt attacker activity across a range of intrusion timelines, and address extortion independently of technical recovery progress. This does not mean guaranteed outcomes — it means tested capability across the conditions most likely to stress each layer.
Recovery procedures account for compromised backup infrastructure, degraded identity systems, and unavailable external dependencies. Emergency access mechanisms are independently protected, monitored, and exercised. Detection identifies attacker behaviors beyond encryption signatures, and containment execution is measured end-to-end. Response authority is pre-defined with documented alternates and escalation paths that have been validated under simulated pressure.
The organization understands what data creates extortion leverage and can respond to publication threats independently of encryption recovery progress. NIST SP 800-61r3 establishes that effective incident response integrates with governance and risk management, which includes pre-defined decision authority and tested escalation paths — not the elimination of appropriate governance. (Source: NIST Computer Security Incident Handling Guide, https://csrc.nist.gov/pubs/sp/800/61/r3/final)
FBI IC3 reporting documents ransomware victims across 14 of 16 critical infrastructure sectors, establishing broad organizational exposure rather than sector-specific risk. (Source: FBI Internet Crime Complaint Center 2025 Annual Report, pages 14–16, https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) Effective readiness spans all three layers because gaps in any layer can constrain the overall response — but capability development is iterative, and organizations should prioritize based on their assessed exposure and current control maturity.
Organizations should validate readiness through exercises that test capability under adversarial conditions, not just normal operations, and should treat exercise findings with corrective actions and owners as the primary output of any readiness evaluation.
Sources
- M-Trends 2024 Executive Edition (ransomware dwell time, page 2): https://services.google.com/fh/files/misc/m-trends-2024-executive-edition.pdf
- CISA Ransomware Guide (backup integrity, restoration testing, preparedness): https://www.cisa.gov/stopransomware/ransomware-guide
- NIST SP 800-184 (recovery planning, testing, and metrics): https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-184.pdf
- Microsoft: Emergency Access Accounts (protected, monitored, and tested emergency administrative access): https://learn.microsoft.com/en-gb/entra/identity/role-based-access-control/security-emergency-access
- NIST SP 800-61r3 (incident response integrated with governance and risk management): https://csrc.nist.gov/pubs/sp/800/61/r3/final
- FBI IC3 2025 Internet Crime Report (reported ransomware exposure, pages 14–16): https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
