# Ransomware Readiness Assessment for Manufacturers > Source: https://netray.co/tools/manufacturer-ransomware-readiness-assessment > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer A 10-question self-assessment that scores how ready a manufacturing site is to prevent, survive and recover from ransomware, including OT and ERP recovery. ## Category industry-templates ## Industry Discrete Manufacturing ## Audience - IT security lead - CIO - Plant IT manager ## Tool **Kind:** assessment **Questions:** #### How are your backups protected from being encrypted or deleted by an attacker? **Help:** Think about the backup server, its credentials and where copies live. **Options:** ##### Backups sit on the same network and domain as production **Score:** 0 ##### Separate backup system, but admin accounts are shared with the domain **Score:** 1 ##### Separate credentials plus one offline or off-site copy **Score:** 2 ##### Immutable or air-gapped copy with separate credentials and MFA **Score:** 3 #### When did you last restore your ERP database and a plant system from backup in a test? **Options:** ##### Never tested **Score:** 0 ##### More than 12 months ago, or only a single file restore **Score:** 1 ##### In the last 12 months for the ERP database **Score:** 2 ##### In the last 6 months, full ERP plus at least one MES or OT server, timed **Score:** 3 #### How is the IT network separated from the plant floor (OT) network? **Options:** ##### Flat network, one VLAN for everything **Score:** 0 ##### VLANs only, routing is mostly open **Score:** 1 ##### Firewall between IT and OT with allow-listed flows **Score:** 2 ##### Firewall plus a DMZ for data historians and remote access, cells segmented **Score:** 3 #### Where is multi-factor authentication enforced? **Options:** ##### Nowhere or email only **Score:** 0 ##### Email and VPN **Score:** 1 ##### Email, VPN and admin accounts **Score:** 2 ##### All remote access, all admin access, ERP and vendor support sessions **Score:** 3 #### How quickly are internet-facing systems patched when a critical vulnerability is published? **Options:** ##### No defined process **Score:** 0 ##### Within a quarter **Score:** 1 ##### Within 30 days **Score:** 2 ##### Within 7 to 14 days, with exceptions tracked **Score:** 3 #### Do you have endpoint detection and response (EDR) with someone watching alerts? **Options:** ##### Basic antivirus only **Score:** 0 ##### EDR on some servers and laptops, no monitoring **Score:** 1 ##### EDR on most endpoints, business-hours monitoring **Score:** 2 ##### EDR on servers and workstations with 24x7 monitoring (in house or managed) **Score:** 3 #### How current is your written incident response plan and contact list? **Options:** ##### No plan **Score:** 0 ##### A plan exists but is more than 2 years old **Score:** 1 ##### Reviewed in the last 12 months **Score:** 2 ##### Reviewed yearly and exercised in a tabletop with plant and executive staff **Score:** 3 #### Could the plant keep shipping for a few days on manual procedures if the ERP and MES were down? **Options:** ##### No, we stop immediately **Score:** 0 ##### Only for a shift or two **Score:** 1 ##### Partly, paper travelers and printed schedules exist for key lines **Score:** 2 ##### Yes, documented downtime procedures are rehearsed and printed copies are current **Score:** 3 #### How well do you know what is on your network, including OT devices? **Options:** ##### No inventory **Score:** 0 ##### IT inventory only **Score:** 1 ##### IT and OT inventory kept manually **Score:** 2 ##### IT and OT inventory with owners, criticality and passive discovery **Score:** 3 #### How are privileged and vendor remote accounts managed? **Options:** ##### Shared admin passwords, vendors have standing VPN access **Score:** 0 ##### Named accounts but no regular review **Score:** 1 ##### Named accounts, quarterly review, vendor access disabled when idle **Score:** 2 ##### Just-in-time privileged access, session logging and approved vendor sessions only **Score:** 3 **Bands:** #### High exposure **Min:** 0 **Max:** 34 **Verdict:** A ransomware event would likely stop production for an extended period and recovery would be improvised. **Recommendations:** - Create an offline or immutable backup copy of the ERP database and key plant servers this month. - Turn on MFA for all remote access and every administrator account. - Write a one-page incident contact list and decision tree before anything else. - Document an inventory of OT devices, even a spreadsheet, so you know what to isolate. #### Partial controls **Min:** 35 **Max:** 59 **Verdict:** Some fundamentals are in place but gaps in recovery testing or segmentation would slow you down in a real incident. **Recommendations:** - Schedule a timed restore test of the ERP and one MES or OT server and record the result. - Put a firewall with allow-listed flows between IT and the plant network. - Run a tabletop exercise with plant management, not only IT. - Define patch deadlines for internet-facing systems and track exceptions. #### Reasonably prepared **Min:** 60 **Max:** 79 **Verdict:** Controls are mostly sound. The remaining risk sits in recovery speed, vendor access and monitoring coverage. **Recommendations:** - Measure recovery time against what the plant can tolerate and close the gap. - Move vendor and privileged access to approved, time-boxed sessions. - Extend monitoring to nights and weekends, in house or through a managed service. #### Strong posture **Min:** 80 **Max:** 100 **Verdict:** You have layered prevention and rehearsed recovery. Keep it current as systems and staff change. **Recommendations:** - Repeat restore tests and tabletops at least yearly and after major system changes. - Track findings to closure with owners and dates. - Review supplier and customer flow-down obligations for incident reporting. ## Content **Intro:** Ransomware crews target manufacturers because downtime is expensive and plants often run old, flat networks. This assessment gives an IT security lead a fast, honest read on how prepared a site is, and what to fix first. **Sections:** #### How to use the assessment **Body:** Answer for one site at a time, choosing the option that describes what is true today, not what is planned. If two people disagree, take the lower score. The score is the share of the maximum points across ten control areas, then mapped to four bands. Print or export the result and attach it to your risk register so you can show movement over time. It works best when the IT lead, a plant engineer and someone who owns the ERP answer together, because each sees different parts of the picture. **Bullets:** - Score each plant separately if networks differ - Take the lower score when unsure - Re-run after every major change or incident #### What the ten questions measure **Body:** The questions follow how ransomware incidents actually unfold in manufacturing: initial access through remote services or phishing, movement from IT into the plant network, destruction of backups, and a slow recovery because nobody had restored the ERP or MES under pressure. They map loosely to common frameworks such as NIST CSF functions and the IEC 62443 idea of zones and conduits, but this is a quick self-check, not an audit or a certification. **Bullets:** - Prevent: MFA, patching, segmentation, privileged access - Detect: EDR and monitoring, asset visibility - Respond: written plan and exercises - Recover: tested backups and manual operating procedures #### Reading the result and common mistakes **Body:** A low band does not mean you are about to be attacked, it means recovery would be painful. The most common mistake is counting backups that were never restored. A second is assuming the plant firewall exists because a firewall appliance was bought. A third is ignoring vendor support access to CNC controllers, PLCs and ERP servers. Treat any zero as a project, and any answer you could not verify as a zero until someone checks. **Bullets:** - Backups that have never been restored are untested, not protected - Check firewall rules, not just the presence of a device - Include contractors and OEM remote support in your answers **Cta:** If you want a second set of eyes on the result, or want recovery runbooks for your ERP generated from your own documentation, Netray can review it with you. The assessment itself needs no contact. **Faq:** #### Is this a formal security audit? **Answer:** No. It is a self-assessment for orientation. A formal review would verify configurations, test restores and review firewall rules. Use the score to decide where to look first and to brief management, not as evidence of compliance with any standard. #### Why does the assessment ask about manual procedures? **Answer:** Most plants cannot restore everything at once. How long you can keep building and shipping on paper travelers and printed schedules often decides how costly an incident is, so it is scored alongside technical controls. #### Does it cover OT specifically? **Answer:** Several questions do: segmentation between IT and OT, OT asset inventory, vendor remote access and restoring plant servers. It does not replace an IEC 62443 risk assessment of individual control systems. #### Does my data leave the browser? **Answer:** No. The assessment runs entirely in your browser and the answers are not sent anywhere. Exporting the result creates a file on your own device. ## Search terms ransomware readiness assessment for manufacturers, ransomware readiness checklist manufacturing, manufacturing ransomware preparedness, ransomware self assessment, plant ransomware recovery readiness, OT ransomware readiness, ransomware assessment questionnaire --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json