IRP Readiness Score

IRP‑D/R Readiness Score

1. Incident Response Plan — 25 Points

Documented Incident Response Plan (IRP) — 5 pts
Yes No

IRP updated within last 12 months — 5 pts
Yes No

Defined roles & responsibilities — 5 pts
Yes No

IRP stored offline / immutable — 5 pts
Yes No

IRP includes ransomware procedures — 5 pts
Yes No

Immutable (ie unchangeable) or offline backups — 5 pts
Yes No

Backups cover servers, endpoints, SaaS, cloud — 5 pts
Yes No

Successful restore test in last 90 days — 5 pts
Yes No

Documented Recovery Time Objective (RTO) — 5 pts
Yes No

Documented Recovery Point Objective (RPO) — 5 pts
Yes No

MFA enforced (email, remote access, admin) — 5 pts
Yes No

EDR deployed on all endpoints — 5 pts
Yes No

Critical patches applied within 14 days — 5 pts
Yes No

Business Email Compromise (BEC) controls (dual‑control + out‑of‑band) — 5 pts
Yes No

Annual tabletop exercise — 5 pts
Yes No

Tabletop includes ransomware scenario — 5 pts
Yes No

DR failover test in last 12 months — 5 pts
Yes No

Executive participation in exercises — 5 pts
Yes No

Mailing Addr: PO Box 192293 Dallas TX 75219