Ransomware is the common case, not the only one. Know what you could restore, and how long it would take, before you need to.
Get Your QuoteMost organizations find out what their recovery is actually worth during the incident, which is the most expensive moment to learn it.
Also called a ransomware audit or, scoped more widely, a cyber recovery audit, it answers three questions before an attacker asks them for you: what could you restore, how long would it take, and what would you lose. Our CISA-certified auditors test the difference between a backup that completes and a backup that restores, and review the controls that decide whether an intrusion becomes an outage:
Our report identifies each specific gap and gives you detailed instructions to close it, ordered so that the changes which reduce your risk the most come first.
Findings are mapped to the frameworks your regulators, insurers, and clients already recognize, so the audit doubles as evidence. Where a ransomware event would also be a reportable breach, we identify the obligation rather than leave it for your counsel to discover later.
A green job status confirms that data was written. It does not confirm that the data can be read back, that it is free of the encryption the attacker already deployed, that the credentials to reach it survive the compromise, or that the restore finishes inside the window your business can absorb. Those are four different questions, and a backup report answers none of them. This audit is built to answer them with evidence rather than assurance, which is why it sits alongside a cybersecurity audit rather than replacing it: that one asks whether an attacker can get in, this one assumes one did.
Ransomware readiness is not a single control. It is four questions asked at four points in an attack, and no one audit answers all of them well. This engagement answers the last question in full and reviews the third, because those two decide whether an intrusion becomes an outage. Here is where the others are covered, so you can scope the parts you need instead of buying one audit that claims all four and goes shallow on every one.
| Before the click | Phishing is the usual way in. Whether your people recognize it, and how fast they report it, is tested in our social engineering and phishing assessment. |
| Getting in and staying hidden | Email controls, endpoint detection and response, and the security operations that should raise an alert are reviewed in our cybersecurity audit. |
| Spreading | Segmentation, privileged access, and how far you have moved toward zero trust decide how much gets encrypted. Reviewed here under containment, and at the network layer in our network security audit. |
| After encryption | Ransomware recovery in practice: what you could restore, how long it would take, and what you would lose, together with your incident response plan and notification duties. This audit, in full. |
Ransomware is the common case, not the only one. Scoped as a cyber recovery audit, this engagement asks the same questions about any event that destroys, encrypts, or corrupts your data, whoever caused it and whatever they used.
Wiper malware leaves nothing to decrypt and no one to pay. A departing administrator with valid credentials needs no malware at all. A compromised cloud or SaaS tenant can delete more in an afternoon than an encryptor manages in a week. And a backup platform that has itself been reached is a destructive event that also removes your remedy. None of those is ransomware. Every one of them ends at the same question: what can you rebuild, and how long does it take.
The wider scope covers everything on this page and adds the parts that only matter once you stop assuming the attacker wanted money:
The deliverable does not change: measured recovery times against the objectives your business actually needs, every gap risk-rated, and specific instructions to close each one. Where your board or your insurer is asking about cyber resilience rather than ransomware specifically, this is the evidence that answers them. Contact us to scope the wider version.
A structured, three-phase approach that establishes what recovery you are entitled to expect, tests what you would actually get, and closes the gap between the two.
We work with your stakeholders to identify critical systems and the data each holds, then establish the recovery time and recovery point objectives the business actually needs, whether or not they have been written down before. You receive a detailed proposal covering project scope and tasks, pricing options, CVs of the assigned audit team, and sample reports.
We examine backup configuration, coverage, immutability, and credential separation, review the evidence that restores have been performed and timed, and assess the containment and detection controls that determine how much would need restoring in the first place. Work is coordinated with your team and scheduled to avoid disruption.
We deliver a report with prioritized findings, risk ratings, and the measured gap between your stated objectives and your demonstrated recovery. We then walk your team through the results and remain available for 90 days of free post-audit support to confirm each gap is properly closed.
This audit is for organizations that need independent evidence of what their recovery is worth, rather than an assurance that backups are running.
| Boards & Executives | Leadership that has been told recovery is covered and wants that claim tested by someone with nothing to sell. |
| Cyber Insurance Applicants | Organizations facing policy conditions on immutable backups, tested restores, MFA, and an exercised response plan. |
| MSP-Reliant Organizations | Companies whose backups are run by a provider who also reports on whether those backups work. |
| Regulated & Contractually Bound Firms | Businesses with breach notification duties or client contracts that specify recovery obligations, often alongside a compliance audit. |
Every finding includes a risk rating, evidence, and detailed instructions to close the gap, ordered so the changes that reduce your risk the most come first.
What each critical system would take to restore, set against the recovery objective it is supposed to meet, so the gap is a number rather than an opinion.
Let your clients, your board, and your cyber insurer know that your recovery has been independently tested. As Certified Information Systems Auditors, we can issue an Auditor Opinion Letter.
Each audit is staffed with:
Altius IT sells no backup software, no recovery platform, and no managed service. Nothing in our report is a product we benefit from you buying, and no finding is shaped by what we would like to install afterwards. That is the difference between an audit and a sales assessment, and it is the reason the finding is worth reading. See why Altius IT.
Anyone can call themselves a security consultant. Altius IT is certified as a Certified Information Systems Auditor (CISA) to audit your environment and issue formal reports and recommendations. Altius IT has been featured in 40+ publications and nationwide media outlets.
No backup software, no recovery platform, no managed service. Nothing in the report is something we sell.
Tested restores and measured recovery times, rather than a backup console reporting success.
Meet HIPAA, GDPR, NIST, ISO, PCI-DSS, SOX, and other compliance standards.
Every engagement includes follow-up support to ensure recovery gaps are properly closed.
Answers to common questions about our ransomware readiness audit.
It is an independent assessment of whether you could actually recover from a ransomware event. We review backup coverage, immutability and offline copies, evidence that restores have been performed and timed, documented recovery objectives, the containment controls that decide whether an intrusion becomes an outage, and your incident response plan. You receive a risk-rated report with specific steps to close each gap.
A cybersecurity audit and a penetration test ask whether an attacker can get in. This audit assumes one did. It measures what you could restore, how long it would take, and what you would lose, which is the question your board and your insurer will ask on the day. The two are complementary and are often scoped together.
No. Ransomware is the common case, and the questions the audit asks apply to any event that destroys, encrypts, or corrupts data: wiper malware, a malicious insider with valid credentials, mass deletion in a cloud or SaaS tenant, or a compromised backup platform. Scoped as a cyber recovery audit it also covers identity rebuild, a clean environment to restore into, and the order systems have to return in.
We review evidence that restores have been performed, timed, and validated, and where scope allows we observe or sample a restore. A backup job that reports success and has never been read back is not evidence of recovery, and the audit is built around that distinction.
The Respond and Recover functions of the NIST Cybersecurity Framework, NIST SP 800-34 contingency planning, and the joint CISA and FBI #StopRansomware Guide. Where a ransomware event would also be a reportable breach, we identify the notification obligation rather than leave it for your counsel to discover later.
No. Altius IT sells no backup software, no recovery platform, and no managed service. Nothing in the report is a product we benefit from you buying, which is what makes the finding worth reading.
Insurers increasingly require evidence of immutable or offline backups, tested restores, multi-factor authentication, and an exercised incident response plan. We audit against the conditions in your policy alongside the frameworks, and the Auditor Opinion Letter gives you independent evidence to submit.
Most engagements take two to four weeks from kickoff to final report, depending on the number of critical systems in scope, how many backup platforms are in use, and how much restore evidence already exists. We confirm the timeline in your proposal before work begins.
A list of critical systems and the data each holds, backup configuration and job history, any restore test records, your recovery objectives if they are documented, your incident response plan, and your cyber insurance conditions. We walk you through everything during planning.
Find out what you could restore, and how long it would take, at a moment of your choosing rather than an attacker's.
Get Your Quote