Scenario 01 / 10 · NIST SP 800-61 REV. 3

Hospital ransomware

A regional hospital loses access to appointment scheduling and a shared imaging folder; bedside systems remain functional but their dependency is unverified.

Fictional training scenario; no real system or person is described.

Safety and authority boundary

Keep clinical safety decisions with the clinical lead; do not disconnect equipment or restore over evidence without approval.

01 / 05

Preparation

GV · ID · PR

A regional hospital loses access to appointment scheduling and a shared imaging folder; bedside systems remain functional but their dependency is unverified.

Your decision. Before opening the response, decide what each named team should do, how it would do it, why, whose approval is needed, and what evidence would change the decision.

Reveal the worked team response

Team	What	How	Why
Aster Evidence team	Prepared an evidence route	Named read-only sources and custodians for: At 08:20 a workstation shows an extortion note; two file shares become unreadable. Endpoint alerts and backup-job logs disagree on the first affected time.	The first alert needs a verifiable provenance and time.
Birch Service team	Rehearsed safe continuity	Tested an isolated version of: Restore scheduling in an isolated environment from a selected clean backup, then reconnect only after clinical workflow testing.	A rushed recovery can worsen the service impact.
Cobalt Decision team	Set authority and escalation	Assigned owners and approval conditions around: Keep clinical safety decisions with the clinical lead; do not disconnect equipment or restore over evidence without approval.	Safety, privacy and communications need accountable decisions.

02 / 05

Detection and analysis

At 08:20 a workstation shows an extortion note; two file shares become unreadable. Endpoint alerts and backup-job logs disagree on the first affected time.

Your decision. Before opening the response, decide what each named team should do, how it would do it, why, whose approval is needed, and what evidence would change the decision.

Reveal the worked team response

Team	What	How	Why
Aster Evidence team	Triaged the signal	Preserved source, UTC time and a second independent check for: At 08:20 a workstation shows an extortion note; two file shares become unreadable. Endpoint alerts and backup-job logs disagree on the first affected time.	One alert is a lead, not proof of cause or scope.
Birch Service team	Measured user impact	Compared the actual service with the scenario baseline: A regional hospital loses access to appointment scheduling and a shared imaging folder; bedside systems remain functional but their dependency is unverified.	Technical alerts alone do not establish operational impact.
Cobalt Decision team	Declared a bounded case	Recorded confirmed facts, unknowns, owner and next review time.	The teams can coordinate without overstating the evidence.

03 / 05

Response and containment

Keep clinical safety decisions with the clinical lead; do not disconnect equipment or restore over evidence without approval.

Your decision. Before opening the response, decide what each named team should do, how it would do it, why, whose approval is needed, and what evidence would change the decision.

Reveal the worked team response

Team	What	How	Why
Aster Evidence team	Preserved and scoped evidence	Saved the original records and defined a bounded path for: Isolate confirmed affected workstations and shares in an owner-approved order while preserving disk and log copies.	Containment must not destroy the basis for later review.
Birch Service team	Applied the approved control	Implemented: Isolate confirmed affected workstations and shares in an owner-approved order while preserving disk and log copies.	A reversible, owner-approved change reduces harm without expanding scope.
Cobalt Decision team	Authorized and communicated	Logged the approver, affected users and constraint: Keep clinical safety decisions with the clinical lead; do not disconnect equipment or restore over evidence without approval.	Response actions need clear authority and proportional notice.

04 / 05

Recovery

Restore scheduling in an isolated environment from a selected clean backup, then reconnect only after clinical workflow testing.

Your decision. Before opening the response, decide what each named team should do, how it would do it, why, whose approval is needed, and what evidence would change the decision.

Reveal the worked team response

Team	What	How	Why
Aster Evidence team	Checked for persistence	Compared new telemetry against: Clinical staff can complete an appointment and retrieve an image; monitoring shows no renewed encryption.	An apparently healthy service can still be compromised.
Birch Service team	Restored in stages	Executed: Restore scheduling in an isolated environment from a selected clean backup, then reconnect only after clinical workflow testing.	A staged return tests dependencies before widening access.
Cobalt Decision team	Accepted the business outcome	Requested owner sign-off only after: Clinical staff can complete an appointment and retrieve an image; monitoring shows no renewed encryption.	Recovery is a service decision, not merely a green dashboard.

05 / 05

Improvement

ID.IM

Rehearse backup isolation, restore ownership, and clinical fallback before the next incident.

Your decision. Before opening the response, decide what each named team should do, how it would do it, why, whose approval is needed, and what evidence would change the decision.

Reveal the worked team response

Team	What	How	Why
Aster Evidence team	Turned uncertainty into a test	Documented the evidence gap and proposed: Rehearse backup isolation, restore ownership, and clinical fallback before the next incident.	A lesson needs a measurable future check.
Birch Service team	Rehearsed the changed control	Assigned an owner and date to test: Rehearse backup isolation, restore ownership, and clinical fallback before the next incident.	An untested action item is not a verified improvement.
Cobalt Decision team	Closed the decision record	Approved resources, tracked the owner and checked the new control later.	Learning must feed Govern, Identify and Protect.

Recovery acceptance test

Clinical staff can complete an appointment and retrieve an image; monitoring shows no renewed encryption.

Improvement to verify

Rehearse backup isolation, restore ownership, and clinical fallback before the next incident.