How to Evaluate a Ransomware Recovery Plan B3 buyer worksheet | Reviewed October 17, 2026 https://b3cyber.com/guides/ransomware-recovery-plan-checklist Vendor / service: ____________________ Buyer / business owner: ____________________ Review date: ____________________ Use case / scope: ____________________ EVIDENCE SCALE 0 = claim only; 1 = dated evidence reviewed; 2 = buyer-witnessed test passed. B3 meeting tool, not a certification. Do not average away a failed critical control. Choose approval blockers before testing. Phase 1: Pre-commitment / discovery [ ] What business function must return first? Choose a critical service with its business owner. Define an acceptable degraded mode and map the dependencies that make even that limited function possible. Evidence score (0/1/2): ___ Test date: ___ Owner: ___ Evidence location / observed result: ____________________ Pass condition / approval blocker: ____________________ Gap / action / due date: ____________________ [ ] What do RTO and RPO mean here? RTO is the target elapsed time to restore the agreed service; RPO is the target limit on lost data measured in time. Record the clock’s start, acceptance endpoint and assumptions instead of accepting a vendor’s generic figures. Evidence score (0/1/2): ___ Test date: ___ Owner: ___ Evidence location / observed result: ____________________ Pass condition / approval blocker: ____________________ Gap / action / due date: ____________________ [ ] Who controls the recovery copy and its keys? List administrative roles, retention changes, backup credentials, encryption keys and emergency access. Check whether compromise of production identity would also compromise or block recovery. Evidence score (0/1/2): ___ Test date: ___ Owner: ___ Evidence location / observed result: ____________________ Pass condition / approval blocker: ____________________ Gap / action / due date: ____________________ [ ] What must suppliers provide during an outage? Confirm restore assistance, replacement capacity, license activation, escalation contacts and evidence delivery. Document dependencies that the organization cannot restore on its own. Evidence score (0/1/2): ___ Test date: ___ Owner: ___ Evidence location / observed result: ____________________ Pass condition / approval blocker: ____________________ Gap / action / due date: ____________________ CHECK YOURSELF: Have business owners agreed on the order of recovery and the consequences of missing each target? Phase 2: Technical & operational proof [ ] Can a second responder restore the service? Run a controlled exercise in isolation. Use a backup responder and the approved emergency access process; simulate unavailable production identity without disabling live safety-critical services. Evidence score (0/1/2): ___ Test date: ___ Owner: ___ Evidence location / observed result: ____________________ Pass condition / approval blocker: ____________________ Gap / action / due date: ____________________ [ ] Is the backup usable and sufficiently protected? Verify retention settings and access separation, then restore an agreed sample including configuration and application data. Compare integrity and completeness against a known baseline. Evidence score (0/1/2): ___ Test date: ___ Owner: ___ Evidence location / observed result: ____________________ Pass condition / approval blocker: ____________________ Gap / action / due date: ____________________ [ ] When can people actually work again? Measure access retrieval, environment preparation, data restore, application validation and business acceptance separately. Record total elapsed time and the age of the recovered data; document excluded steps. Evidence score (0/1/2): ___ Test date: ___ Owner: ___ Evidence location / observed result: ____________________ Pass condition / approval blocker: ____________________ Gap / action / due date: ____________________ [ ] Who approves clean reconnection? Have the incident lead define the evidence needed before returning the restored environment to service, including investigation of the entry path and credential or configuration changes. A restored machine is not automatically a trusted machine. Evidence score (0/1/2): ___ Test date: ___ Owner: ___ Evidence location / observed result: ____________________ Pass condition / approval blocker: ____________________ Gap / action / due date: ____________________ CHECK YOURSELF: If we removed the engineer who built the backup system from the room, would the documented process still work? Phase 3: Incident, failure & exit scenarios [ ] Can we communicate without corporate email or SSO? Test an approved independent contact route and keep a protected offline contact list. Confirm who can authenticate instructions and which sensitive information must stay out of informal channels. Evidence score (0/1/2): ___ Test date: ___ Owner: ___ Evidence location / observed result: ____________________ Pass condition / approval blocker: ____________________ Gap / action / due date: ____________________ [ ] What if an employee receives a personal threat? Use a clearly announced tabletop scenario. Route the report to named HR, security and legal contacts; preserve evidence, arrange appropriate support and define emergency escalation. Do not send simulated threats to staff without their knowledge. Evidence score (0/1/2): ___ Test date: ___ Owner: ___ Evidence location / observed result: ____________________ Pass condition / approval blocker: ____________________ Gap / action / due date: ____________________ [ ] What if the supplier is also unavailable? Exercise the alternate path for backup access, recovery capacity and essential documentation. Record which services cannot operate without a specific provider and the business-approved fallback. Evidence score (0/1/2): ___ Test date: ___ Owner: ___ Evidence location / observed result: ____________________ Pass condition / approval blocker: ____________________ Gap / action / due date: ____________________ [ ] Who closes the exercise gaps? Assign each missed objective an owner and retest date. Preserve incident evidence and follow applicable notification processes; do not delete material merely because a service has resumed. Evidence score (0/1/2): ___ Test date: ___ Owner: ___ Evidence location / observed result: ____________________ Pass condition / approval blocker: ____________________ Gap / action / due date: ____________________ CHECK YOURSELF: Can a person who is tired, worried or covering another role find the next safe action without guessing? DECISION [ ] Approved for stated scope [ ] Conditional [ ] Blocked Decision owner and date: ____________________ Accepted exceptions and expiry: ____________________ Retest trigger and date: ____________________ NEXT ACTIONS Next 7 days: Choose one critical business service. Verify that two authorized people can locate its protected recovery copy, recovery credentials and offline instructions. Next 30 days: Restore that service in an isolated exercise with production identity treated as unavailable. Have the business owner test its minimum useful function and sign the measured results. Next 90 days: Close and retest the largest gaps. Codify ownership, supplier dependencies, emergency communications and evidence requirements; repeat after material system or identity changes.