A ransomware readiness assessment tests whether your business can detect, contain, and recover from an attack without paying a ransom or losing critical data. Run one across five stages: asset and backup inventory, attack surface review, a tabletop exercise that walks your team through a live scenario, a backup restoration test, and a gap remediation plan. Most UK SMEs complete a first-pass assessment in 2-4 weeks. The exercise almost always surfaces one hidden problem: backups that exist on paper but have never been restored under time pressure.
Why this matters
Ransomware doesn't care how big you are. A five-person accountancy practice and a 500-seat SaaS company face the same encryption event, the same ransom note, and the same 72-hour UK GDPR breach clock.
What separates a bad day from a business-ending one is whether the recovery path was tested before the attack, not during it. A ransomware readiness assessment in 2026 is the cheapest insurance policy you'll never file a claim on.
Most businesses don't fail because they lack antivirus. They fail because nobody checked whether the backup actually restores, whether the incident response plan names a real decision-maker, or whether staff know who to call at 2am on a Saturday.
How to run a ransomware readiness assessment step by step
- Inventory critical assets and data flows. List every system that would stop the business if encrypted: file servers, CRM, finance systems, production databases. You can't protect what you haven't mapped.
- Audit your backup strategy against the 3-2-1 rule. Three copies of data, on two different media types, with one copy offline or immutable. Confirm this in writing, not from memory.
- Run a backup restoration test. Pick a real file server or database, restore it to a clean environment, and time how long it takes. This is the step most businesses skip and the one that matters most.
- Review your attack surface. Check exposed RDP ports, unpatched VPN appliances, and admin accounts without MFA — three of the most common ransomware entry points.
- Run a tabletop exercise. Walk leadership and IT through a simulated ransomware event: who declares the incident, who talks to the insurer, who decides whether to pay. Full guidance sits in the tabletop exercise playbook.
- Score gaps and build a remediation plan. Rank each finding by exploitability and business impact, then assign an owner and a deadline — not a vague promise that IT will look into it.
Readiness assessment vs penetration test vs tabletop exercise
These three exercises get confused constantly. They test different failure modes, so run all three on a rolling basis in 2026.
| Method | What it tests | Best for |
|---|---|---|
| Ransomware readiness assessment | Backup recovery, patching, access controls, response plan | Businesses that have never formally tested recovery — run this first |
| Penetration test | Whether an attacker can actually breach your network | Businesses that want proof their controls hold under attack |
| Tabletop exercise | Human decision-making during a live incident | Leadership teams who've never rehearsed who does what |
If you've run none of the three, start with the readiness assessment. It tells you whether a penetration test would even find anything new.
Why ransomware readiness assessment results vary
No two assessments come back with the same findings. The gap usually traces to one of these:
- Backup age and testing frequency — a backup last restored 18 months ago is not a backup, it's a hypothesis.
- Patch cadence on internet-facing systems — VPN appliances and RDP gateways stay a favourite ransomware entry point.
- MFA coverage on admin and remote access accounts — a single unprotected admin login undoes months of other controls.
- Segmentation between corporate and production networks — flat networks let ransomware spread from one laptop to the whole estate.
- Staff phishing susceptibility — most ransomware still starts with a clicked link, not a zero-day exploit.
- Whether the incident response plan names actual people — "the IT team will handle it" fails the moment the IT team is asleep.
These factors compound. A business with old backups, unpatched RDP and no MFA isn't three times more exposed than one with a single gap. Attackers only need one open door.
How often should you run a ransomware readiness assessment?
Run a full ransomware readiness assessment at least once a year and re-test backup restoration every quarter. Attack surface changes fast — a new SaaS tool, a new remote hire, or one unpatched appliance can undo a year of good controls in weeks.
Is a ransomware readiness assessment the same as Cyber Essentials?
No. Cyber Essentials certifies five baseline controls — firewalls, secure configuration, access control, malware protection and patch management — but it doesn't test recovery. A ransomware readiness assessment goes further by proving you can restore after an attack, not just that you meet a baseline. Many UK businesses run both in 2026, treating certification as the floor and pairing it with the broader control set in the NCSC 10 Steps to Cyber Security.
Do you need managed detection to be ransomware-ready?
Not strictly, but detection speed decides whether an incident stays contained. A managed detection and response service shortens the window between initial compromise and containment, which matters because ransomware groups often sit inside a network for days before triggering encryption.
OneClickComply doesn't run the technical simulation. It automates the evidence collection behind the controls a readiness assessment checks — patch records, access reviews, policy sign-offs — so the audit trail already exists when the assessment starts.
Automate the evidence behind your controls
Keep patch, access and policy evidence audit-ready all year.
Frequently asked questions
One last thing
The finding that surprises most businesses in 2026 isn't a missing firewall rule or an unpatched server. It's discovering the backup they've paid for every month has never once been restored. Test the restore before you need it, not during the incident.
That's the whole point of a readiness assessment, and the whole point of seriously simple cyber compliance: prove the control works before someone else tests it for you.