Black-start ransomware readiness exercise

On October 23, 2026, the Roundtable converged on a measurable exercise after an industry-impact contribution described a repeatable ransomware loss path reported as recently as August 2026: compromised credentials or vulnerable edge access followed by control disablement, data theft, backup disruption, and encryption.

That sequence directly tests whether a credential compromise remains a contained event or becomes a Tier-1 recovery crisis. The action does not depend on the reported 600-victim count or an unsupported monetary estimate, and it should not be delayed while the absent SafePay advisory is obtained.

SOC analysts must detect and isolate the simulated intrusion within 30 minutes.

VPN and identity operators must test whether a compromised remote-access credential can lead to privilege escalation. EDR operators must determine whether monitoring and defensive controls remain effective when EDR disablement is simulated.

Backup, NAS, and recovery teams must prove that production credentials cannot delete or modify recovery copies and that an immutable copy supports clean-room restoration.

Tier-1 service owners must restore one encrypted service with verified integrity within the lesser of eight hours or its approved recovery-time objective while meeting its recovery-point objective. Boards receive escalation when any criterion fails.

Users dependent on the selected Tier-1 service face the operational consequence of delayed or unverified restoration. The evidence names no specific VPN, EDR, NAS, backup product, firmware, software version, or vendor, so each deployment must map the exercise to its own named technology stack.

Support — The industry-impact contribution describes a repeatable loss path from compromised credentials or vulnerable edge access to control disablement, data theft, backup disruption, and encryption, while explicitly declining to infer financial losses from the reported victim count.

Support — The defense-architecture contribution turns that path into an unannounced exercise covering a compromised VPN credential, privilege escalation, EDR disablement, shadow-copy or NAS deletion, exfiltration, encryption of one Tier-1 service, containment, and clean-room restoration from immutable backup.

Support — The board-readiness exchange asks for a binary, measurable test that distinguishes rapid containment from a material recovery crisis and records concrete containment and recovery criteria.

Evidence gap, not contradiction — The evidence assessment confirms repeated support for the exercise but finds that the underlying government advisory is absent, preventing independent verification of the external attribution.

The industry-impact analyst identified a board-relevant path from compromised credentials or vulnerable edge access through control disablement, data theft, backup disruption, and encryption, while rejecting unsupported estimates of financial harm.

The defense architect converted that path into an unannounced, measurable black-start exercise with containment, backup-integrity, recovery-time, and recovery-point criteria.

The evidence assessment found strong support for the exercise itself but identified a key gap: the underlying government advisory was not supplied, so its attribution and exact threat sequence could not be independently checked.

The publication-boundary assessment therefore separated the operational recommendation from the unverified attribution. The arbiter adopted the exercise and removed the external attribution. A decision-linking check found no prior record to update, resulting in a new decision record.