The backup restores. The incident team can join its meeting. The logs are retained. The patch is scheduled.
Those are useful results. But what did the test assume?
Perhaps the administrator was trusted, corporate sign-in was available, the logs were already searchable, and the business had stopped creating new records.
Across Cyber Briefs #037–#042, the recurring weakness is an untested assumption about what happens outside normal conditions. The important question is not only whether a control works. It is whether the organization has rehearsed the point where its usual way of working stops.
Change one assumption
A failure-path exercise deliberately changes a condition: the usual approver is unavailable, a critical update cannot be installed, or investigators need evidence outside the live search window.
That does not mean breaking production to see what happens. Start with a tabletop, test tenant, representative sample, or isolated recovery environment. Agree authorization, scope, stop conditions, and rollback before any technical exercise.
The UK NCSC’s guidance on preparing people for disruptive incidents recommends exercises that explore how staff would operate without normal systems or processes, involving business roles as well as technical responders.
Our recommendation is to make the missing condition explicit. “We discussed ransomware” is less informative than “the response lead had to contact the supplier without company email.”
A tabletop can expose missing ownership. It cannot demonstrate that a technical restriction actually blocks an action. Choose the exercise that can answer the question.
Test the exception, not just the schedule
A patch calendar describes the intended route. The harder test begins when a critical system cannot follow it.
Microsoft’s October 6 vulnerability-management perspective urges security leaders to reconsider patch timing for critical systems and emphasizes defense in depth when vulnerabilities cannot all be fixed in time. This is vendor guidance, not one universal deadline for every organization.
The useful exercise is a delayed fix: who accepts the remaining exposure, which temporary measures apply, when does that decision expire, and what change would trigger immediate escalation?
The same discipline applies before a finding enters the patch queue. Microsoft’s October 7 FORGE research account describes the importance of working builds, reproducible triggers, and reachable execution paths.
For your team, the question is whether a report remains convincing after its assumptions are checked against the actual environment. A plausible explanation is not a confirmed vulnerability. Equally, an unsuccessful reproduction attempt does not establish that the system is safe.
Keep reproduction authorized and isolated; do not turn triage into an unapproved attack on production.
Look for the result that should not happen
Some controls should be tested through denial.
Azure Backup’s Resource Guard documentation requires separation between the backup administrator and specified Resource Guard permissions. Supported critical operations are protected through additional authorization; protection also depends on the configured operation scope.
The transferable lesson is not that every backup action requires two people to sign. It is that separate role names are insufficient if one identity still holds both sets of authority.
In a safe test environment, can an administrator without the additional authorization perform a protected action? Check effective permissions, inherited access, exclusions, and the result—not just the role diagram. Do not test this by deleting live recovery assets.
Evidence access needs an outcome test too. OMB memorandum M-26-14 distinguishes immediately searchable logs from retrievable data that requires preparation. Its requirements apply to covered U.S. federal agencies, not automatically to every small business.
The operational distinction travels well: retained evidence may still require access approval, restoration, preparation, and a working query. Select an older known event and measure the path from request to usable answer.
Rehearse the missing dependency
A second incident channel is not independent if its invitation, login recovery, and contact list all depend on the unavailable corporate account.
The NCSC recommends secure alternative communications and offline contact information for incidents in which normal platforms are unavailable or untrusted.
Try the fallback without normal company sign-in. Can the deputy find the instructions, establish who is joining, reach the provider, and share only appropriate information?
Do not treat an improvised personal group chat as an approved incident channel. The fallback needs access controls, participant verification, and information-handling rules of its own.
The purpose is to discover circular dependencies before responders encounter them under pressure.
Test the way back
An exercise that ends when the server returns may stop before the business is ready.
The NCSC’s recovery guidance, reviewed October 1, recommends planning how information created through workarounds will be reconciled with restored systems and setting review dates for those workarounds.
Consider an illustrative order-processing exercise. During a simulated outage, staff record a few synthetic orders through an approved temporary process. When the test system returns, the business owner checks for missing orders, duplicates, conflicting changes, and the point at which normal processing resumes.
A successful restore and a correct order book are different outcomes. Include both in the test. The temporary process also needs to be retired or explicitly reviewed, not silently become permanent.
One workflow, three checks
For this week, choose one important workflow and run a proportionate exercise with its business owner and technical lead:
- Remove one assumption. Name the unavailable dependency or denied action, the expected behavior, and the safety limits.
- Observe the outcome. Record what actually happened, including delays, unexpected permissions, missing evidence, and decisions nobody could authorize.
- Complete the return. Reconcile temporary work, remove exercise access, assign improvements, and repeat the failed step after the fix.
This is an ovniTEK exercise, not a prescribed NIST procedure. NIST CSF 2.0’s ID.IM-02 addresses identifying improvements from security tests and exercises, including collaboration with suppliers and relevant third parties.
A pass is bounded evidence about the scenario tested, not proof that every incident will be manageable.
Which assumption would you rather discover in a rehearsal than during a real disruption?
Sources and further reading
Microsoft vulnerability-management perspective · Microsoft FORGE research · Azure Backup Resource Guard · OMB M-26-14 · NCSC preparation · NCSC recovery · NIST CSF 2.0
Cyber Brief Weekly is an independent ovniTEK publication. NIST CSF 2.0 references provide educational alignment, not NIST endorsement, certification, or a guarantee of security.