How to evaluate ransomware readiness across security, recovery, and response