Appendix A: Ransomware Resilience Self-Review

Answer “Yes / Partial / No,” and for “Yes,” attach the location of the evidence and the date last confirmed. The purpose is not self-assessment for its own sake, but to connect it to an improvement plan.

Assets and Exposed Surface

• Externally exposed assets and their responsible parties are continuously tracked.
• VPNs, remote administration, web administration surfaces, and the cloud management plane have a reason and an expiration for their exposure.
• Unpatched or end-of-support assets are made visible as an exception, isolation, or replacement plan.
• The log collection destination and retention period for critical assets are known.

Identity and Privilege

• Privileged identities are separated from everyday identities.
• Strong MFA is applied to privileged and external access.
• Service, emergency, shared, and outsourcing-partner identities are inventoried.
• MFA registration, privilege elevation, conditional-access exceptions, and app consent can be monitored and reviewed.
• Deactivation upon resignation, transfer, or contract termination is verified.

Endpoints, Network, and Management Plane

• Endpoint/server patching, protection, administrator privilege, and exceptions are managed.
• The trust boundary between administrative endpoints and general-use endpoints is separated.
• The administrative pathways for identity, virtualization, EDR, network, and backup are understood.
• Unnecessary lateral-movement pathways are reduced, and exception traffic is reviewed periodically.

Data and Recovery

• The location, owner, retention period, and external sharing of critical data are known.
• Backups are protected within a trust boundary distinct from production.
• There is a record of restoring from backup at the business-operation level and verifying success.
• Peripheral elements needed for recovery — identity, configuration, certificates, keys, DNS, and the like — can also be restored.
• The recovery order and the business sign-off party are decided.

Response and Business Continuity

• There is a 24-hour contact network for technical staff, management, legal, public relations, and outside experts.
• There is a timeline format that separates fact, hypothesis, and unconfirmed items.
• The authority to decide isolation, account suspension, and shutdown of external exposure is clear.
• There are incident-communication and cooperation procedures with outsourcing partners and cloud providers.
• Tabletop exercises and technical restoration exercises are conducted, and improvement items are tracked through to completion.