How the calculation works
Each question is worth up to the points in the table; the maximums add up to 100. A full answer earns all the points, a partial answer about half, and “No” or “Not sure” earns none, because a control you can’t confirm can’t be relied on during a recovery. Restore testing earns fewer points the longer ago the last test was.
Score = points earned out of 100, rounded to a whole number.
Band:
- Most controls in place: 80 or more, and every critical control at full points.
- Important gaps: 50 to 79, or 80 or more with a critical control not fully in place.
- Major gaps: below 50.
Gaps are every question below full points, listed by points lost (most first), then critical before other controls, then question order. Each one says why it matters and what to do.
These weights are ITBroker.com’s own, not a standard or an insurer’s scoring model:
| Control | Points | Critical | Partial answer |
|---|---|---|---|
| Immutable or offline backup copy | 15 | Yes | 7 (some systems) |
| Restore testing | 12 | Yes | 8 (last 12 months), 3 (more than a year) |
| MFA on backup consoles and admin accounts | 10 | Yes | 5 (one of them) |
| EDR coverage | 9 | 6 (all devices, not watched 24/7), 3 (some) | |
| 3-2-1 copies | 8 | 4 | |
| Separate backup credentials | 8 | 4 | |
| Recovery runbook | 8 | 4 (written, not exercised) | |
| Privileged access (separate admin accounts) | 8 | 4 | |
| Patching speed (internet-facing systems) | 7 | 4 (within a month) | |
| Offline plan, contacts and credentials | 5 | 2 | |
| Email filtering | 5 | 2 (basic spam filtering) | |
| Incident response retainer | 5 | 2 (known firm, no contract) |
The controls follow recommendations in CISA’s #StopRansomware Guide: offline, encrypted backups that are tested regularly; an incident response plan with a hard copy and an offline version; phishing-resistant MFA; separate administrator accounts and least privilege; timely patching of internet-facing systems; EDR; and email filtering. The two-week patching line is ITBroker.com’s choice for a “fast” answer, not a CISA deadline.
The score is a self-check of what you answered. It doesn’t measure configuration quality and isn’t a prediction of whether an attack will happen or succeed. Answers are codes in the page address, so a shared link carries no typed text.
Worked example
A company with a nightly backup to an appliance, a cloud copy for some systems and EDR without overnight monitoring answers:
| Question | Answer | Points |
|---|---|---|
| Immutable or offline copy | For some systems | 7 of 15 |
| 3-2-1 copies | Yes | 8 of 8 |
| MFA on backup consoles and admin accounts | One of them | 5 of 10 |
| Separate backup credentials | No, same domain accounts | 0 of 8 |
| Restore testing | More than a year ago | 3 of 12 |
| Recovery runbook | Written, not exercised | 4 of 8 |
| Offline plan, contacts and credentials | No | 0 of 5 |
| EDR coverage | All devices, not watched 24/7 | 6 of 9 |
| Patching speed | Within a month | 4 of 7 |
| Email filtering | Attachments and links scanned | 5 of 5 |
| Privileged access | Yes | 8 of 8 |
| Incident response retainer | Known firm, no contract | 2 of 5 |
Points earned: 7 + 8 + 5 + 0 + 3 + 4 + 0 + 6 + 4 + 5 + 8 + 2 = 52 out of 100, in the Important gaps band. Three of the 12 controls are fully in place.
The nine gaps, by points lost: restore testing (9), immutable or offline copy (8, critical, so it comes before separate backup credentials), separate backup credentials (8), MFA on backup consoles and admin accounts (5, critical), offline plan, contacts and credentials (5), recovery runbook (4), then EDR coverage, patching speed and the incident response retainer (3 each). The top three all concern the backups themselves: whether they would survive and whether they restore.
Sources
- CISA, #StopRansomware Guide (September 2023): preparation and prevention best practices, including offline encrypted backups, backup testing, a hard-copy and offline incident response plan, MFA, separate admin accounts, patching, EDR and email filtering.
