Direct answer
Blast-radius mapping starts with common control paths, not server lists. Trace identity, endpoint management, hypervisors, storage administration, backup orchestration, DNS and secrets. Systems sharing a privileged identity or automation channel should be treated as one failure domain even when they run in different locations.
How to frame the decision
Architecture decisions should be evaluated against shared failure domains. Geographic distance alone does not create independence when identities, management tools or deletion privileges are shared.
For this decision, document the protected service, assumed compromise, required recovery point and the maximum acceptable time to a trusted business state. Keep product capability, configured capability and tested capability as three separate fields: they are rarely identical.
Decision table
The following factors convert the decision into requirements that can be reviewed, tested and retained as evidence.
| Factor | Practical guidance | Evidence to retain |
|---|---|---|
| Identity coupling | List every service that trusts the same identity provider, privileged group or recovery email path. | A dependency graph that remains usable when the identity provider is unavailable. |
| Management coupling | Treat common RMM, MDM, hypervisor and scripting platforms as potential simultaneous-compromise paths. | A table of agents, service accounts and remote execution scope. |
| Storage coupling | Identify snapshots, replicas and backups that share deletion credentials or lifecycle policies. | A destructive-action matrix for each copy and controlling role. |
Validation procedure
Run this procedure in a non-production or isolated recovery environment. Define a named owner and time limit before the test begins.
- Draw the actual trust and data flows before changing controls.
- Translate the requirement into a pass/fail test for map the ransomware blast radius before designing backup.
- Capture timestamps, logs, restored-object counts and operator actions for each decision factor.
- Repeat the test with one dependency unavailable so the result reflects a hostile recovery, not a clean demo.
A pass means the recovery outcome and supporting evidence meet the pre-declared requirement. A partial restore, undocumented manual workaround or result that depends on an unavailable production service should be recorded as an exception—not rounded up to a success.
Common failure modes
These conditions can make a compliant-looking design unusable during an actual recovery.
- Geographic separation is mistaken for administrative separation.
- A backup appliance is isolated at the network layer but joined to the same directory.
- Emergency documentation is stored only in the affected collaboration tenant.
Failure modes should become tabletop injects and technical tests. If the team has never performed the recovery while one normal dependency is unavailable, the runbook describes a best-case restore rather than a ransomware recovery.
Evidence checklist
Keep this evidence with the recovery plan so that a reviewer can distinguish a documented capability from a reproduced result.
- Record the design decision, owner, exception and next test date.
- A tested requirement exists for: Identity coupling.
- A tested requirement exists for: Management coupling.
- A tested requirement exists for: Storage coupling.
- Evidence includes a date, environment, operator and reproducible procedure.
- The exception path identifies who can accept residual risk.
Frequently asked questions
These answers state the decision in plain language and preserve the conditions that can change it.
How do you calculate ransomware blast radius?
Blast-radius mapping starts with common control paths, not server lists. Trace identity, endpoint management, hypervisors, storage administration, backup orchestration, DNS and secrets. Systems sharing a privileged identity or automation channel should be treated as one failure domain even when they run in different locations. The deciding factors in this guide are identity coupling, management coupling, storage coupling.
Are cloud backups in a separate failure domain?
Treat the answer as conditional on the actual environment and plan. Treat common RMM, MDM, hypervisor and scripting platforms as potential simultaneous-compromise paths. Retain a table of agents, service accounts and remote execution scope.
Which management systems can compromise backups?
Do not rely on the product label or a successful backup job alone. Test the requirement directly: identify snapshots, replicas and backups that share deletion credentials or lifecycle policies. Record the result with a date, operator and named exception owner.