Ransomware Readiness Assessment Questions

Q. No.

Question

NIST CSF Ref

Q.01

Have all the locations of storage for your organization's critical information/data been identified? (This includes, but is not limited to removable media, cloud storage, systems servers, internal networks and partners).

ID.AM-3
PR.PT-2
DE.CM-6

Q.02

How does your organization track the IT equipment and devices it owns?

ID.AM-1
ID.AM-5

Q.03

Has your organization established different levels of data protection according to its sensitivity?

ID.AM-5
PR.DS-1
PR.DS-5
PR.IP-6
PR.PT-2

Q.04

Does your organization have software/application restrictions in place in a way that prevents execution of unapproved/malicious programs?

ID.AM-1
ID.AM-2
ID.AM-3
ID.AM-4
ID.AM-5
ID.AM-6

Q.05

How does your organization do when keeping up with trends in security vulnerabilities in systems and addressing them?

ID.GV-3
ID.RA-1
ID.RA-2
PR.IP-6
DE.DP-2
PR.IP-5
PR.IP-12
RS.AN-5
RS.MI-3

Q.06

How confident are you that your organization has a good overall understanding of your information asset lifecycle (including third-party agreements) that includes provisions for securing and protecting information, and securely removing, transferring and decommissioning assets and or data?

ID.GV-3
ID.RA-1
PR.AC-2
PR.IP-5
PR.DS-3

Q.07

How does your organization manage risks, including cyber security risks and third-party exposure? Is there a risk register that captures and monitors these risks?

PR.AT-3
ID.AM-6
ID.GV-4
ID.RA-3
ID.RA-5
ID.RA-6
ID.RM-1
ID.RM-2
ID.RM-3
DE.CM-6
RS.MI-3

Q.08

Are you confident your organization is aware of the existing internal and external cyber security risks and threats it faces and is ready to handle it according to their relative importance?   

ID.GV-4
ID.RA-2
ID.RA-3
ID.RA-4
ID.RA-5
ID.RA-6
ID.RM-1
ID.RM-2
PR.IP-7
PR.IP-12
DE.CM-6
RS.MI-3

Q.09

Does your organization have a formal process for managing the lifecycle of user accounts including creation, verification, revocation, and periodic review for authorized devices, users and processes?

PR.AC-1
PR.AC-3
PR.AC-4

Q.10

How do users authenticate when connecting remotely to your environment?

PR.AC-7

Q.11

Does your organization manage remote access (such as VPN), including management of user accounts, in a way that it monitors and records any security events?

PR.AC-3
PR.MA-2
PT.PT-1
DE.CM-7

Q.12

Are you confident that your organization only gives the required access that people need, including external partners, in order to perform their activities, to the systems and data they need access to?

PR.AC-1
PR.AC-4
PR.AC-3
PR.PT-3
PR.MA-2

Q.13

How does your organization make sure that its mission-critical systems and any other important systems are segmented from the rest of your IT environment?

PR.AC-2
PR.AC-3
PR.AC-5
PR.DS-6
PR.DS-7
PR.IP-2

Q.14

Does your organization require additional protection like the use of multi-factor authentication, that adds an extra layer of security, to verify the identity of users trying to access any of your critical systems, networks or information (whether on or off site)?

PR.AC-1
PR.AC-7
PR.DS-5

Q.15

Does your organization restrict the use of privileged accounts?

Q.16

Does your organization have a cyber security awareness program? If yes, does it specifically cover phishing training and social engineering? And do you have a reporting mechanism that is used by your employees?

PR.AT-1

Q.17

How confident are you that all service accounts, and employees (or any other parties) who have access to the systems, networks and applications of your company use secure passwords?

PR.DS-5
PR.AC-1

Q.18

Are you confident that your organization has the right capabilities (e.g., processes, tools, devices and security controls) to prevent and detect malicious activities/within your environment?

PR.AC-3
PR.AC-5
PR.DS-6
PR.PT-1
DE.AE-2
DE.AE-4
DE.AE-5
DE.CM-1
DE.CM-4
DE.CM-6
DE.CM-8
DE.DP-2
RS.AN-4

Q.19

Does your organization utilize hardened Standard Operating Environment or Gold Disks and are these reviewed and updated on a regular basis?

PR.IP-1
PR.IP-3
PR.PT-3

Q.20

Does your organization have security mechanisms/filters like Proxy, Web Filter to prevent malicious traffic from communicating externally?

PR.PT-4
DE.AE-1
DE.CM-1
DE.CM-3
DE.CM-4
DE.CM-5
DE.CM-6
DE.CM-7

Q.21

Does your organization have security mechanisms/filters to reduce and detect malicious activities via email like Phishing attacks?

PR.PT-4
DE.AE-1
DE.CM-1
DE.CM-3
DE.CM-4
DE.CM-5
DE.CM-6
DE.CM-7

Q.22

Does your organization provide remote access via Remote Desktop (RDP)?

PR.AC-3
PR.AC-7
PR.MA-2
PT.PT-1
DE.CM-7

Q.23

Have you limited the use of Microsoft Office Macros?

N/A

Q.24

How are operating systems patched? And to what schedule?

RS.AN-5
RS.MI-3

Q.25

How are applications patched? And to what schedule?

RS.AN-5
RS.MI-3

Q.26

Does your organization have a formalized process for triaging information for detected events of potentially suspicious activity?

DE.AE-1
DE.AE-2
DE.AE-3
DE.AE-4
DE.AE-5
RS.AN-2

Q.27

Does your organization employ a centrally managed anti-malware solution to prevent and detect malware infections on your systems?

DE.CM-3
DE.CM-4

Q.28

Does your organization use host-based and network-based intrusion detection technologies to monitor your environment for anomalies in real-time?

PR.PT-4
DE.AE-1
DE.CM-1
DE.CM-3
DE.CM-4
DE.CM-5
DE.CM-6
DE.CM-7

Q.29

Where relevant, i.e. where third parties have direct access to your networks, systems or data, What measures are taken to minimize the cyber security risk inherited from your suppliers?

DE.CM-6
ID.BE-1
ID.SC-2

Q.30

Does your organization conduct vulnerability scans across your environment on a regular basis?

ID.AM-4
ID.RA-1
PR.IP-12
DE.CM-8
RS.AN-5
RS.MI-3

Q.31

Does your organization routinely perform penetration tests on your IT environment?

DE.CM-6
DE.CM-8

Q.32

Does your organization have measures in place to monitor, alert and record any security events (i.e. attempted unauthorized access, or other strange behavior) on your key systems and networks and make sure they are brought to the attention of the right people?

DE.CM-3
DE.CM-7
DE.DP-1
DE.AE-2
DE.AE-5
DE.DP-3
DE.DP-4
DE.DP-5
RS.CO-2
RS.AN-1
DE.CM-1
DE.CM-2
PR.PT-1

Q.33

Do you think your organization is prepared to effectively respond to a cyber security incident?

PR.IP-8
PR.IP-9
PR.IP-10
RC.RP-1
RC.IM-1
RS.IM-2
DE.AE-2
DE.DP-4
RS.RP-1
RS.AN-1
RS.AN-2
RS.AN-3
RS.AN-4
RS.MI-1
RS.MI-2

Q.34

Is your organization prepared to respond to an emergency situation like one which affects your most critical systems?

ID.BE-4
ID.BE-5
RS.MI-1

Q.35

How does your organization test and update response plans? Does the testing include relevant suppliers and third-parties?

RS.RP-1
RS.AN-4
RS.AN-5
RS.IM-1
RS.IM-2
ID.SC-5
PR.IP-9
PR.IP-10
RS.CO-3

Q.36

Does your organization have a regular backup process for critical systems and information? Is the restoration process regularly tested?

ID.BE-5
PR.IP-4
RC.RP-1

Q.37

Does your organization have a business continuity plan? Is this subject to periodic testing, including relevant suppliers and third-parties, and upon significant changes in the environment?

ID.BE-5
ID.SC-5
PR.IP-9
PR.IP-10
RC.IM-1
RC.IM-2

Q.38

Does your organization possess and have tested the right technologies and processes to recover critical systems affected by a security event?
Does the testing include relevant suppliers and third-parties?

ID.BE-5
RC.RP-1
RC.IM-1
RC.IM-2
PR.DS-4

Q.39

How does your organization test and update recovery plans? Does the testing include relevant suppliers and third-parties?

ID.BE-5
ID.SC-5
PR.IP-9
PR.IP-10
RS.CO-3
RC.IM-1
RC.IM-2

Q.40

If one of your organization's critical systems is affected by a cyber-attack, do you have a notion of what stakeholders should be contacted?

ID.BE-1
RS.CO-1
RS.CO-2
RS.CO-3
RS.CO-4
RS.CO-5
RC.CO-1
RC.CO-2
RC.CO-3

Q.41

Do you have insurance policies that may assist in the case of a ransomware/cyber-attack and is this reviewed regularly?

N/A