A Six-Page IR Plan, an Untested Backup, and a 24-Hour Vendor Clause
Meridian Clinics operates 14 sites with 1,100 staff; its EHR is vendor-hosted. The incident response plan is a six-page PDF last edited in 2019. It defines three severity levels and names the CIO as incident commander, but contains no call tree, no out-of-band communication method, no forensic retainer, and no legal or regulatory contact. Backups run nightly to a NAS in the same server room, joined to the same domain, using the same domain administrator service account; the last restore test was in 2021. The EHR vendor contract requires written notification within 24 hours of any suspected compromise of data. State breach law allows 30 days; HIPAA allows 60. The board has approved a tabletop exercise next month and asked for a scenario with measurable objectives. Budget covers exactly one of: immutable offsite backup, 24/7 managed detection and response, or a forensic retainer.
1. Identify the three most consequential plan gaps and explain how each would degrade the response during a real ransomware event.
Read the worked answer
Backups are inside the blast radius. Same room, same domain, same domain admin service account as production. Any ransomware operator who reaches domain admin encrypts the NAS with the servers, and the recovery option disappears at the moment it is needed. The untested restore is the second half of the same gap: a restore that has never been performed against the 2021-era procedure is a plan, not a capability, and the first real test should not happen during an incident.
No out-of-band communication or call tree. If email and the phone system are encrypted or unavailable, the organization cannot convene the people who decide, and the 24-hour vendor notification clause starts running from suspicion, not from confirmation. Miss that window and you are in contract dispute while still handling the intrusion.
No named legal and regulatory path. The 30-day and 60-day clocks are not the hard constraint; the 24-hour vendor clause is, and the decision to notify is a legal call nobody in the plan is empowered to make. Without pre-identified counsel and a documented notification criterion, the team will debate jurisdiction while the clock runs.
Secondary but real: the CIO as sole commander with no alternate creates a single point of failure for the first hour.
2. Design the tabletop: objectives, participants, injects, and how you will measure success.
Read the worked answer
Objectives, stated as testable outcomes: convene the response team within 60 minutes without email; make and record a notification decision on the vendor clause within 24 hours; demonstrate who has authority to take the EHR offline; and produce a written list of gaps with owners.
Participants: CIO and alternate, IT operations, clinical operations lead from a site, legal or outside counsel, communications, the EHR vendor account manager, and a scribe. Clinical presence is not optional; the decisions that matter are about patient care, not servers.
Injects, timed to create pressure: hour 1, file server encryption and helpdesk phones down. Hour 2, the backup NAS is found encrypted and the 2021 restore documentation is unusable. Hour 3, the vendor sends a written request for notice and cites the 24-hour clause. Hour 4, a local reporter calls. Hour 5, one site reports it cannot access charts and asks whether to divert patients.
Measurement: time to convene, time to notification decision with rationale recorded, whether the diversion decision was made by the correct role, and the count of injects that produced an unowned action. Score against objectives, not against improvisation quality. Publish the gap list within five business days, each item with an owner and a date.
3. Recommend how to spend the single budget line, and defend the choice against the other two options.
Read the worked answer
Buy immutable offsite backup, and treat the other two as procurement paths that can be activated reactively.
Reasoning from the plan's own failure modes: the dominant loss scenario for a 14-site clinic is destructive ransomware that reaches domain admin, and the one control that determines whether the organization survives that scenario is a recoverable copy outside the domain. MDR is valuable, but it reduces dwell time on a compromise you might contain; it does nothing when encryption has already happened and the backups are gone. A forensic retainer is useful, but it can be engaged after an event, and many cyber insurers provide panel firms, so it is the least constrained by budget timing.
One caveat to state to the board: immutable backup without a restore test is still a paper control. Attach the purchase to a commitment to test a full restore of the 4-hour ERP recovery objective within 90 days, with results reported to the board. If leadership refuses the testing commitment, the MDR argument becomes stronger, because at least then detection is real rather than documented.
Also use the exercise to quantify the 24-hour vendor clause; if the tabletop shows notification is achievable, the remaining risk is concentrated in recovery, which reinforces the backup decision.