0 / 24

Model 53 of 74 · Cybersecurity

Incident Response & Cyber Resilience Maturity Assessment

Assess how well your organisation prepares for, responds to, and recovers from cyber incidents such as ransomware.

Pillars & areas

Prepare

Be ready before it happens

  1. 01Preparation & Planning
  2. 02Escalation & Decision-Making

Respond

Act fast and decisively

  1. 03Containment & Eradication
  2. 04Recovery & Backup Resilience

Recover

Restore and learn

  1. 05Communication & Legal Obligations
  2. 06Exercises & Post-Incident Learning

Levels

  1. 1UnrehearsedImprovised response
  2. 2Playbook-ReadyPlanned & exercised
  3. 3Battle-TestedPractised & resilient

01 Preparation & Planning

Is the organisation ready to respond, with a plan, clear roles and the support it needs arranged in advance?

0/4 answered

PP-1Does your organisation have a cyber incident response plan?

Think about whether there is a current, approved plan that people know about and can access during an incident — including if normal systems are down.

PP-2How clearly are incident roles and responsibilities defined?

Consider technical, executive, legal, communications and business roles, and deputies for each.

PP-3Does your organisation have playbooks for common incident types?

Think about ransomware, data breach, account compromise, business email compromise, supplier compromise and denial of service.

PP-4What external support is arranged in advance?

Consider incident response specialists, legal advisers, cyber insurers, forensic providers and key technology suppliers.

02 Escalation & Decision-Making

Are incidents recognised and escalated quickly, with clear authority to make difficult decisions?

0/4 answered

ED-1How quickly are potential incidents recognised and declared?

Think about how long it takes from the first suspicious signs to someone formally declaring an incident.

ED-2How are senior leaders involved during a serious incident?

Consider when and how executives are informed, and whether they know what is expected of them.

ED-3How are difficult decisions made under pressure?

Think about decisions like shutting down systems, notifying regulators, engaging law enforcement or responding to ransom demands.

ED-4How is response activity coordinated?

Consider how technical, business, legal and communications workstreams stay aligned, especially if email and collaboration tools are unavailable.

03 Containment & Eradication

Can the organisation stop an attack spreading and remove the attacker completely?

0/4 answered

CE-1How quickly can your organisation contain an attack?

Think about isolating devices, disabling accounts, blocking network traffic and cutting connections to compromised systems.

CE-2How is evidence preserved during an incident?

Consider whether logs and system images are kept so the incident can be investigated properly.

CE-3How does your organisation make sure an attacker has been fully removed?

Think about hidden access such as backdoors, stolen credentials and compromised accounts that could let an attacker return.

CE-4How well can the organisation keep operating during an incident?

Consider manual workarounds and alternative ways of working if key systems are unavailable.

04 Recovery & Backup Resilience

Can critical systems and data be restored from trusted backups within agreed timescales?

0/4 answered

RB-1How well are backups protected from attackers?

Ransomware attackers routinely target backups. Think about whether backups could be deleted or encrypted using compromised administrator accounts.

RB-2How often are restores tested?

Consider whether you have actually restored critical systems from backup recently, not just checked that backups completed.

RB-3How are recovery priorities and timescales defined?

Think about whether the order in which systems would be restored, and how quickly, has been agreed with the business.

RB-4Could your organisation rebuild its core infrastructure after a destructive attack?

Consider identity systems, networks and management tools — if these were compromised, could you rebuild them from a trusted state?

05 Communication & Legal Obligations

Are communications during incidents timely and honest, and are legal and regulatory obligations met?

0/4 answered

CL-1How are staff kept informed during an incident?

Think about telling employees what is happening, what they should and shouldn't do, and how to get updates if email is down.

CL-2How are customers, partners and the public informed?

Consider external statements, customer notifications and handling media enquiries.

CL-3How are legal and regulatory notification obligations managed?

Think about data protection breach notification deadlines, sector regulators and contractual obligations to customers.

CL-4How does your organisation work with insurers and law enforcement?

Consider insurer notification requirements and when to involve the police or national cyber security agencies.

06 Exercises & Post-Incident Learning

Is response capability practised regularly, and does every incident and exercise lead to improvement?

0/4 answered

XL-1How often does your organisation exercise its incident response?

Think about tabletop exercises, technical simulations and full-scale rehearsals.

XL-2How involved are executives and the board in exercises?

Consider whether senior leaders practise their crisis decision-making role.

XL-3How are incidents reviewed after they are resolved?

Think about whether there is a structured review of what happened, what worked and what didn't.

XL-4How are improvements from incidents and exercises tracked?

Consider whether agreed improvements are actually implemented.

Self-assessment report

Incident Response & Cyber Resilience

Answer the questions above and your report builds here: an overall score, a score and target for each area, and the three changes that matter most.

About this model

About the Incident Response & Cyber Resilience maturity model

No organisation can prevent every cyber attack. Ransomware, data theft, account takeover and supplier compromise affect organisations of every size and sector, and the difference between a manageable incident and a crisis usually comes down to preparation. Organisations that have planned, practised and built recoverable systems contain incidents quickly and resume operations within days. Those that haven't can face weeks of disruption, difficult decisions made under pressure, regulatory penalties and lasting reputational damage.

This model assesses the organisation's ability to respond to and recover from cyber incidents as a whole-organisation capability, not just a technical one. It covers planning and readiness, detection and escalation, containment, recovery and backup resilience, communication and legal obligations, and learning through exercises and reviews. It complements the Security Operations model, which focuses on day-to-day monitoring and detection, and the Business Continuity & Resilience model, which covers disruption of all kinds.

The Incident Response & Cyber Resilience maturity model contains 24 questions across 6 areas: preparation and planning, escalation and decision-making, containment and eradication, recovery and backup resilience, communication and legal obligations, and exercises and post-incident learning. Each question describes three levels of maturity through observable practices. It is designed for organisations of any size, including those that rely on external providers for incident response.

Who this assessment is for

  • CISOs, IT directors and security managers
  • Incident response, security operations and IT operations teams
  • Executives and board members who would lead crisis decisions
  • Legal, communications, privacy and risk teams
  • Business continuity and resilience managers

The three maturity levels

  • Level 1 — Unrehearsed: The organisation has no tested incident response plan, or one that sits unread. Roles and decision-makers are unclear, contact details for key people and providers are not readily available, and backups have never been tested against a destructive attack. A serious incident would be handled by improvisation, with uncertain outcomes and a real risk of missing legal notification deadlines.
  • Level 2 — Playbook-Ready: A documented incident response plan defines roles, severity levels, escalation and decision-making, supported by playbooks for common scenarios such as ransomware and data breach. Backups are protected from tampering and restores are tested. Communication and notification obligations are understood, external support is arranged in advance, and the plan is exercised at least annually.
  • Level 3 — Battle-Tested: Incident response is a practised, organisation-wide capability. Leaders and teams have rehearsed realistic scenarios, decisions are made quickly with clear authority, and incidents are contained before they spread. Critical services can be rebuilt from trusted backups within agreed timescales, communications are timely and honest, and every incident and exercise leads to measurable improvements in resilience.

The 6 areas assessed

1. Preparation & Planning

The groundwork for effective response. This area covers the incident response plan, roles and responsibilities, scenario playbooks, and arrangements with external specialists, insurers and suppliers.

2. Escalation & Decision-Making

How incidents are recognised, escalated and led. This area covers incident declaration and severity, escalation to leadership, decision-making authority, and the coordination of response activities.

3. Containment & Eradication

How the organisation limits damage and removes threats. This area covers containment capabilities, evidence preservation, eradication of attacker access, and the ability to operate safely during an incident.

4. Recovery & Backup Resilience

How the organisation recovers from destructive attacks. This area covers backup protection and isolation, restore testing, recovery priorities and timescales, and the ability to rebuild core infrastructure such as identity systems.

5. Communication & Legal Obligations

How the organisation communicates and meets its obligations. This area covers internal communication, communication with customers and the public, regulatory and legal notifications, and engagement with insurers and law enforcement.

6. Exercises & Post-Incident Learning

How the organisation builds and improves its capability. This area covers tabletop and technical exercises, executive involvement, post-incident reviews, and tracking of resilience improvements.

How this model relates to other frameworks

This is an original, simplified maturity model and is not derived from or intended to replace any of the following. However, organisations that use this assessment may also find value in these established frameworks:

  • NIST SP 800-61 (Incident response recommendations) — guidance on incident response aligned with the NIST Cybersecurity Framework
  • ISO/IEC 27035 (Information security incident management) — an international standard for planning and managing security incidents
  • UK NCSC Cyber Assessment Framework and incident management guidance — guidance from the UK National Cyber Security Centre on responding to incidents
  • CISA ransomware guidance — practical guidance on preventing and recovering from ransomware
  • ISO 22301 (Business continuity management) — the international standard for business continuity, closely related to cyber recovery

Frequently asked questions

What is the Incident Response & Cyber Resilience maturity model?

Assess how well your organisation prepares for, responds to, and recovers from cyber incidents such as ransomware. It is an original, simplified model with three maturity levels (Unrehearsed, Playbook-Ready and Battle-Tested), assessed through 24 questions across 6 areas: Preparation & Planning, Escalation & Decision-Making, Containment & Eradication, Recovery & Backup Resilience, Communication & Legal Obligations and Exercises & Post-Incident Learning.

How long does the Incident Response & Cyber Resilience assessment take?

Most people finish in 10–14 minutes. Each of the 24 questions has three concrete answer options. Your progress is saved in the page URL, so you can bookmark it and come back later.

How is the score calculated?

Each answer scores 1 (Unrehearsed), 2 (Playbook-Ready) or 3 (Battle-Tested). An area's score is the average of its answered questions, and the overall score is the average of the area scores, so every area counts equally. Scores run from 1.0 to 3.0.

Is my data stored or shared?

No. Your answers are never sent to a server. They are stored only in the page URL, which you control. Copy the link to share results with colleagues, or export a PDF or CSV report.

How should I use the results?

Start with "Where to focus" in your report. It lists the questions with the biggest gap to the target you set for each area, and shows what the next level looks like in practice. For a fuller picture, ask several people from different teams to complete the assessment and compare their links. Differences in perception are often as revealing as the scores themselves.