A hospital cybersecurity exercise should end with a restore
Use a controlled recovery exercise to learn whether staff can regain access to the systems they need.
Pick a dependency that matters
Start with a service used in a daily clinical workflow. Write down which systems, accounts and network connections it depends on, and which workflows teams would run during downtime.
Run the restore in isolation
Use a non-production environment and approved test data. Ask the team to recover a backup, verify access with the intended roles and check whether the recovered service can communicate with the systems it needs. Compare the recovered state with the expected backup time.
Practice the handoff back to operations
Have an operations owner verify that the restored data is usable. Record the actual recovery time, the amount of data that would need reconciliation, and the work still needed before returning to normal operations.
Make the next drill measurable
HHS lists backup and incident preparedness practices among its voluntary healthcare cybersecurity performance goals. Turn the drill results into a short list of owned actions, with specific recovery steps to retest after changes.
Sources
HHS — Healthcare and Public Health Sector Cybersecurity Performance Goals
ASPR TRACIE — Healthcare System Cybersecurity Readiness and Response Considerations