Most organisations can list their ransomware controls, but few can say how ready they actually are to prevent, survive and recover from an attack, or what to fix next. This maturity model gives a five-level scale, from Ad hoc to Optimised, across six capability areas: governance, prevention, privileged and machine identity, detection, backup and recovery, and response. Each level is defined by evidence an assessor can check, not by the existence of a policy. It is written for CISOs, resilience and IT leaders who need a baseline, a defensible target and a roadmap, and for executives who want a simple way to track progress. The controls themselves are explained in the Ransomware Prevention Guide; this page stages them.
Key takeaways
- Score the weakest area, not the average: an organisation with excellent detection and deletable backups is at the backup level when ransomware arrives, so the overall rating is the lowest area score.
- Evidence decides the level: a tested full restore, an exercise report or a coverage figure counts; a policy, a purchase order or a vendor dashboard on its own does not.
- Level 3 is the realistic target for most: Defined means documented, owned, consistently applied and tested at least annually, which removes most of the outcomes that turn an intrusion into a multi-week outage.
- Identity is a capability area of its own: ransomware operators run on stolen and abused accounts, including service accounts and backup credentials, so privileged and machine identity is assessed separately rather than buried in prevention.
- Anchor to recognised outcomes: the areas map to NIST CSF 2.0 outcomes and to NIST IR 8374 Rev. 1, the CSF 2.0 ransomware community profile published as final in June 2026, so results translate into language auditors and regulators recognise.
The five levels
| Level | Name | Description |
|---|---|---|
| 1 | Ad hoc | Controls exist where individuals put them. No ransomware-specific plan, backups unverified, administrator access broad and undocumented. Recovery would be improvised. |
| 2 | Developing | Key controls are being introduced (MFA on some remote access, backups for main systems, an incident response plan in draft) but coverage is partial, ownership unclear and nothing has been tested end to end. |
| 3 | Defined | Documented standards with named owners apply across the estate. Remote and privileged access use MFA, backups are immutable or offline, the response plan is approved and exercised, and a full restore of a critical service has been tested in the last 12 months. |
| 4 | Managed | Controls are measured. Coverage, restore times and detection performance are reported as metrics against targets; exceptions are tracked and time limited; exercises include executives, suppliers and realistic scenarios. |
| 5 | Optimised | Readiness improves continuously from threat intelligence, exercises and incidents. Recovery is routinely rehearsed at scale, standing privilege is close to zero, and lessons from industry incidents are turned into tested changes within a defined time. |
Capability areas
Assess each of the six areas separately. The table shows what each looks like at Levels 1, 3 and 5; Levels 2 and 4 sit between them.
| Area | Level 1 Ad hoc | Level 3 Defined | Level 5 Optimised |
|---|---|---|---|
| Governance and risk | Ransomware not on the risk register; no executive owner | Named executive owner; exposure quantified for critical services; payment decision process agreed with legal; board briefed annually | Exposure modelled per service and updated after changes; board reviews readiness metrics quarterly; insurance attestations reconciled with evidence |
| Prevention and exposure | Patching ad hoc; internet-facing systems unknown; MFA optional | Internet-facing inventory maintained; known exploited vulnerabilities patched to a defined deadline; MFA on all remote access; email and macro controls standard | External attack surface monitored continuously; phishing-resistant MFA for remote access; unsupported systems removed or isolated; supplier access governed |
| Privileged and machine identity | Shared administrator accounts; service accounts unknown; help desk resets on caller say-so | Separate admin accounts with MFA; tiered administration for directory and backup systems; service account inventory with owners; verified help desk reset process | Just-in-time privilege; near-zero standing domain and cloud admins; machine credentials rotated and monitored; identity threat detection on directory changes |
| Detection and monitoring | Antivirus only; logs not retained | EDR on servers and endpoints; central logging with retention; alerts for backup deletion, mass file changes and new admin rights triaged | Detections tested against ransomware behaviours; hypervisor and cloud control planes monitored; mean time to contain tracked and falling |
| Backup and recovery | Backups on the same domain and credentials; restores never tested | Immutable or offline copies; backup administration isolated with separate identities; restore order agreed; full restore of a critical service tested annually | Isolated recovery environment; regular large-scale restore rehearsals; recovery time measured against objectives; golden images and identity recovery rehearsed |
| Incident response | No plan, or a generic plan stored on the network | Ransomware playbook approved by the chief executive; offline contacts; retainer in place; tabletop exercise each year with actions closed | Exercises include executives, suppliers, legal and communications; decision records and reporting deadlines rehearsed; post-incident lessons applied across the estate |
Evidence by level
Assessors should ask for evidence, and accept a level only when the evidence for it is present across the whole area.
| Level | Acceptable evidence | Not sufficient on its own |
|---|---|---|
| 2 Developing | Draft plans, project plans with dates, partial coverage reports | A purchased product that is not yet deployed |
| 3 Defined | Approved standards with owners; MFA and EDR coverage reports; restore test record with date, scope and duration; exercise report with an action list | A backup job "success" report; a policy with no coverage figures |
| 4 Managed | Metrics against targets over at least two reporting periods; exception register with expiry dates; supplier participation in exercises | One-off snapshots; metrics without targets |
| 5 Optimised | Records of changes made from threat intelligence or exercises; repeated large-scale recovery rehearsals; independent assurance results | Statements of intent; vendor maturity badges |
Framework mapping
The areas line up with outcomes in the NIST Cybersecurity Framework 2.0, which NIST IR 8374 Rev. 1 applies to ransomware, and with NIST SP 800-53 Rev. 5 controls.
| Area | NIST CSF 2.0 outcomes | NIST SP 800-53 Rev. 5 |
|---|---|---|
| Governance and risk | GV.OC-04, GV.RM-01, GV.OV-01, GV.SC-07 | CP-2 Contingency Plan |
| Prevention and exposure | ID.AM-01, ID.RA-01, PR.PS-02 | RA-5 Vulnerability Monitoring and Scanning |
| Privileged and machine identity | PR.AA-05 | AC-6 Least Privilege; IA-2 Identification and Authentication |
| Detection and monitoring | DE.CM-01, DE.CM-03 | SI-4 System Monitoring; AU-6 Audit Record Review |
| Backup and recovery | PR.DS-11, RC.RP-01, RC.RP-03 | CP-9 System Backup; CP-10 System Recovery and Reconstitution; CP-4 Contingency Plan Testing |
| Incident response | RS.MA-01, RS.AN-03, RS.CO-02, ID.IM-02, ID.IM-04 | IR-4 Incident Handling; IR-8 Incident Response Plan |
The behaviours the model is built to defeat correspond to MITRE ATT&CK T1486 Data Encrypted for Impact, T1490 Inhibit System Recovery, T1078 Valid Accounts and T1190 Exploit Public-Facing Application.
How to run the assessment
- Set scope: agree which business units, sites and cloud tenants are in scope, and list the top five critical services with their technical dependencies, including identity providers, hypervisors and backup platforms.
- Assign area owners: one owner per capability area gathers evidence; a separate reviewer, ideally from internal audit or an external assessor, challenges it.
- Collect evidence first, score second: request coverage reports, restore test records, exercise reports and the service account inventory before any scoring workshop, so ratings are argued from documents rather than opinion.
- Score per area: use the self-assessment questions below; record the evidence reference against every yes.
- Calibrate: compare scores across areas and with previous assessments; where an owner claims a jump of more than one level in six months, re-check the evidence.
- Report and plan: present the area scores, the overall (lowest) level and the top five gaps with owners and dates; agree target levels for the next 12 months.
Expect the first assessment to take two to four weeks of part-time effort in a mid-sized organisation. Repeat assessments are faster because the evidence pack is maintained between cycles.
Self-assessment questions
Answer each question yes only with evidence. Two or more "no" answers in an area cap that area at the level below the question.
Governance and risk
- Is there a named executive owner for ransomware readiness? (Level 2)
- Is ransomware exposure quantified, in days of outage and cost, for the top five critical services? (Level 3)
- Is there a written payment decision process with authority, criteria, legal and sanctions checks? (Level 3)
- Does the board or a committee review readiness metrics against targets at least twice a year? (Level 4)
Prevention and exposure
- Is every internet-facing system known and owned? (Level 3)
- Are vulnerabilities in the CISA Known Exploited Vulnerabilities catalogue patched or mitigated within a defined deadline, with compliance reported? (Level 3)
- Does all remote access, including supplier access, require MFA, and is it phishing resistant? (Level 3 for MFA; Level 5 for phishing resistant everywhere)
Privileged and machine identity
- Do administrators use separate accounts, with MFA, for privileged work? (Level 3)
- Are directory, virtualisation and backup administration separated so that one compromised account cannot control all three? (Level 3)
- Is there an inventory of service accounts and other machine credentials with owners, and are interactive logons by them alerted? (Level 3)
- Is the number of standing privileged accounts measured and falling? (Level 4)
Detection and monitoring
- Is EDR deployed on at least 95 per cent of servers and endpoints, with gaps known? (Level 3)
- Do alerts fire for backup deletion, shadow copy deletion, mass file renames and new administrator rights, and are they triaged around the clock? (Level 3)
- Are detections tested against ransomware behaviours at least annually? (Level 4)
Backup and recovery
- Is at least one copy of critical data immutable or offline? (Level 3)
- Are backup systems administered with identities that do not exist in the production directory? (Level 3)
- Has a full restore of a critical service, including its identity dependencies, been tested in the last 12 months, and was the measured time within objective? (Level 3, Level 4 if measured against target)
- Is there an isolated recovery environment for rebuilding identity and core services? (Level 5)
Incident response
- Is there a ransomware playbook, approved by the chief executive, with offline copies? (Level 3)
- Is a retainer or named external responder in place, with contact details held offline? (Level 3)
- Has an exercise involving executives, legal and communications run in the last 12 months, with actions closed? (Level 3; Level 4 if suppliers participate)
Moving up: roadmap
- From Level 1 to 2 (first 90 days): appoint the executive owner; inventory internet-facing systems and administrator accounts; turn on MFA for remote access; confirm backups exist for critical systems and take one copy offline; draft a ransomware playbook from the Ransomware Playbook Template.
- From Level 2 to 3 (6 to 12 months): make backups immutable and move backup administration to separate identities (see the Backup Identity Isolation Guide); separate admin accounts and tier directory, hypervisor and backup administration; complete the service account inventory; deploy EDR widely; run the first full restore test and first executive exercise; agree the payment decision process.
- From Level 3 to 4 (12 to 24 months): set targets and report metrics; introduce just-in-time privilege for administrators; test detections against ransomware behaviours; extend exercises to suppliers; track exceptions with expiry dates.
- From Level 4 to 5 (ongoing): build an isolated recovery environment; rehearse large-scale recovery including identity rebuild (see Recovering IAM and PAM After Ransomware or Domain Compromise); feed threat intelligence on active groups into control changes; seek independent assurance.
Small versus large organisations: a small business can reach Level 3 with a managed service, cloud backups with immutability, MFA everywhere and an annual tabletop; Level 4 and 5 assume dedicated security operations and are rarely justified below that scale. See Ransomware Basics for Small Businesses Guide. Large and regulated organisations should target Level 4 for backup and recovery and for privileged identity, since those two areas set the size of the loss.
Measuring progress
- Lowest area score (the overall rating) and the score per area, tracked each half year.
- Measured recovery time for the top five critical services against objective.
- Percentage of remote and privileged access with phishing-resistant MFA.
- Number of standing privileged accounts, human and machine.
- Median days to remediate known exploited vulnerabilities on internet-facing systems.
- Percentage of exercise and assessment actions closed on time.
Common failure patterns
- Averaging the scores: reporting "Level 3.2 overall" while backups sit at Level 1 hides the area that decides the outcome.
- Counting purchases as maturity: an immutable storage licence or EDR contract scores nothing until coverage and tests are evidenced.
- Restore tests that skip identity: data restores that assume the directory is available prove little; a real recovery often starts with rebuilding identity.
- Ignoring the help desk and suppliers: strong technical scores while password resets and supplier access remain weak. The Marks and Spencer cyberattack began with impersonation of a third-party user.
- Self-assessment without challenge: teams rating their own areas without independent review tend to score one level high.
Lessons from incidents
The Jaguar Land Rover cyberattack shows the cost of recovery at scale: systems were shut down from 31 August 2025 and phased restart of production began only on 8 October 2025. Whatever the entry point, the length of an outage is set by the backup and recovery and incident response areas of this model, which is why they should be tested at scale rather than assumed. A useful test after reading any major incident write-up is to ask, area by area, which level would have shortened the outage or prevented the loss, and whether the organisation can evidence that level today. Where the answer is no, the gap goes straight onto the roadmap with an owner and a date.
Practitioner checklist
- Agree the six areas and the evidence rules with the executive owner before scoring.
- Score each area with evidence, and report the lowest area as the overall level.
- Have at least one area reviewed independently, starting with backup and recovery.
- Set a target level per area for 12 months, with Level 3 as the minimum for backup and privileged identity.
- Turn every "no" answer into a dated action with an owner.
- Re-run the assessment every six months and after any major incident or exercise.
- Report the area scores and the six progress metrics to the risk committee.
- Use the Ransomware Executive Briefing to present results to the board.
Standards and references
- NIST: IR 8374 Rev. 1 Ransomware Risk Management: A Cybersecurity Framework 2.0 Community Profile
- NIST: Cybersecurity Framework 2.0
- NIST: SP 800-53 Rev. 5
- CISA, FBI, NSA and MS-ISAC: #StopRansomware Guide
- CISA: Known Exploited Vulnerabilities Catalog
- MITRE ATT&CK: Data Encrypted for Impact
- MITRE ATT&CK: Inhibit System Recovery
Related NHI Mgmt Group resources: Ransomware Prevention Guide · NIST IR 8374 Rev 1 Ransomware Risk Management Profile Guide · Incident Response Maturity Model · Backup Security and Immutable Backup Guide