Scenario readiness check · 5 weeks · with your IT team

Ransomware readiness check: how your company works without ERP and CRM, and what downtime costs

In five weeks we test how sales, warehouse, production and finance work without ERP and CRM, whether data really restores from backups and what each day of downtime costs. First findings in week two. Under NDA.

5 weeksfrom kick-off to the report to the owner

Week 2first findings and the cost of a downtime day

A real restore testbackups checked together with your IT

Under NDAonly your IT touches the systems

AED 109,000one company or site · excl. VAT · travel within the GCC included

Discuss on Zoom See what you get

What it gives you

Five questions owners and chief executives bring to us, and the answer you get.

“How many days can we work without ERP and CRM?”A process map: what stops in the first hour, in the first day and after a week, and how to work by hand.
“Can we restore from backups, and how fast?”A restore test with your IT: the real time against the declared one.
“How do we take orders and ship without systems?”Paper forms, a procedure for manual accounting and backup channels to customers and suppliers.
“Who tells customers what in the first hours?”A response plan: roles, decisions and message texts for customers, staff and partners.
“How much would we lose?”The loss and the cost of a downtime day in AED, the weak points and what to fix first. A two-page report to the owner.

What stops when ERP and CRM are encrypted

An illustrative company: sales, warehouse, production and accounting all work through one server room. In your report the diagram follows your processes and systems.

Ransomware readiness check: diagram of an illustrative company where the server room with ERP and CRM is encrypted and the links to sales, warehouse, production and accounting are cut

data encrypted
link between a department and the systems lost

1Sales and customers. Orders, contracts and customer history in the CRM.
2Warehouse and shipping. Stock, delivery notes, routes.
3Production. Work orders, recipes, quality control.
4Accounting and purchasing. Invoices, payments, payroll.
5Server room. ERP, CRM, email and backups on one network.

First hourOrders stopCRM and email are down
4 hoursThe warehouse cannot see stockshipments stop
1 dayInvoices and paymentspurchasing and payments stop
3 daysProduction without work orderscustomers move to competitors
7 daysPayroll and reportingcontract penalties begin

Illustrative example: how the damage grows while the systems are down.

Why it is worth doing now

An attack takes hours. Preparing for it takes five weeks. Here is what 2026 data from the UAE shows.

Attacks keep rising.In September 2026 organisations in the UAE faced on average 2,521 cyber attacks a week, 47% more than a year earlier.Check Point Research via Security MEA, 9 October 2026
Recovery is getting slower.Only 48% of UAE organisations hit by ransomware recovered within a week, down from 63% a year earlier. The average recovery cost, without any ransom, was USD 665,208.Sophos, The State of Ransomware in the UAE 2026, July 2026
Regulators expect an operational resilience framework.In February 2026 the Central Bank of the UAE issued the Operational Risk and Operational Resilience Regulation (C1/2026). It requires licensed financial institutions to establish comprehensive frameworks for operational risk and operational resilience.Hadef & Partners, 26 August 2026
What you can do this week.Check that one backup copy is kept off the network, print the contacts of key customers and suppliers, and agree a backup channel for management.

How the work goes and when you get results

Five weeks from the first meeting to the report to the owner. Every step ends with a document you keep.

Week 1Kick-off and NDAProcesses, systems, backups, key contracts.
Week 2Interviews and process reviewSales, warehouse, production, finance, IT.First findings: three weak points and the cost of a downtime day
Week 3Restore testYour IT restores a system from a backup; we time it.
Week 4Exercise without systemsManagement and key teams work through the attack scenario for three hours.
Week 5Report to the ownerWeak points, losses in AED, the plan and paper forms.

Time from your people: one to two days for IT on the restore test; one to two hours of interviews each for the heads of sales, warehouse, production and finance; three hours for management in the exercise.

Loss in money, before and after the measures

We choose the measures with your IT and management and rank them by the loss each dirham avoids.

Illustrative example

TodayAED 12 million

After measuresAED 3.2 million

−73%loss after the measures

AED 930,000cost of one day of downtime

9 → 2 daysto resume shipments

Illustrative example: a trading and manufacturing company with revenue of AED 400 million a year.

What you keep

Four documents used by the owner, management, IT and the key teams. Figures in the samples are illustrative.

Report to the owner

Weak points, losses in AED and what to fix first.

Map of processes without ERP and CRM

What stops and when, and how to work by hand.

Restore test record

The real restore time and what shortens it.

Response plan and paper forms

Roles, message texts and forms for manual work.

Why clients trust us

We see the processes, contracts and weak points of the company. So the rules for data and access are fixed before we start.

NDA before the first working meeting.We sign your non-disclosure agreement or offer ours.
Only your IT touches the systems.We do not ask for admin rights. Your IT restores from a backup on a test bench or in an agreed window; live systems keep running.
Your data stays with you.We hand the report to you. On our website and in talks we use only anonymised examples.
Experience.Evgeny Telenkov built business continuity from scratch at a large mining and metals company, with more than 20 plans for its sites. He has led risk functions in telecom, oil and gas and consulting (EY), and was Chief Risk Officer of a USD 20 billion petrochemical megaproject. Deputy Chair of Technical Committee 010 “Risk Management” of Rosstandart, Russia’s national standards body, and co-author of six GOST R national standards.
Industries.Mining and metals, oil and gas and petrochemicals, telecom, manufacturing.
External testing on request.An external penetration test and a simulated attack are run by a specialised information-security partner under a separate contract and NDA with you.

Price

The price is for one company, or one site with a shared IT environment. For a group of companies we send a quote within two working days.

AED 109,000one company or site, 5 weeks, excl. VAT

Discuss on Zoom

If within six months you order the Resilience audit and improvement programme, 50% of the price of the check is credited.

Options

One company or site — AED 109,000.Processes, a restore test, an exercise and the report to the owner.
Both checks — AED 189,000 instead of AED 218,000.Ransomware and drone strike: IT and the site, one report to the owner.
External penetration test and simulated attack — on request.Run by our information-security partner under a separate contract. Priced after the call, once the scope is clear.

Good to know

Prices exclude VAT.The final amount is fixed in the contract.
Travel and accommodation within the GCC are included.For sites outside the GCC we agree travel costs before the start.

Frequently asked questions

Will you hack our systems?

No. The readiness check looks at how the company gets through an attack: processes, backups and management decisions. If you need an outside test of your defences, a specialised information-security partner runs a penetration test and a simulated attack under a separate contract and NDA with you.

Will you stop our ERP for the test?

No. We test the restore on a test bench or in an agreed window. Your IT does everything in the systems; we observe and time it.

We have a security team and backups. Why do we need this?

The security team protects you from the attack. The check answers the owner’s next question: what happens if protection fails. How sales and the warehouse work without systems, how long a restore really takes and what each day of downtime costs.

What data do you need, and who sees it?

A list of processes and systems, your backup routine, and key contracts with customers and suppliers. Everything is shared under NDA, and the report stays with you.

How much time does it take from our people?

IT: one to two days for the restore test. The heads of sales, warehouse, production and finance: one to two hours of interviews each. Management: three hours in the exercise.

Does it help with Central Bank or NCEMA 7000 requirements?

It gives you dated evidence: a restore test with measured times, an exercise with recorded findings and a plan of fixes. Evidence like this feeds both an operational resilience framework and a business continuity system under AE/SCNS/NCEMA 7000. The check does not replace either of them.

How is this different from the Resilience audit and improvement programme?

The check covers one scenario in five weeks and ends with a report to the owner. The programme builds continuity for the whole company: plans, roles, exercises and metrics. 50% of the price of the check is credited if you move to the programme within six months.