Cyber Crime Tabletop Exercise for Health Care Facilities

This exercise is part of our catalog of tabletop exercises for health care facilities.

Scenario Overview

Participants are the management team for a fictional nursing home when, without warning, the internal network slows to a crawl, outgoing email refuses to send, and employee workstations begin to reboot unexpectedly. Normal operations are disrupted immediately, and leadership must determine whether the organization is facing a cyber attack, a systems failure, or something more serious.

As the situation unfolds, the management team must evaluate the operational impact, coordinate internal communications, and determine how to maintain critical services while the disruption continues. This scenario focuses on leadership response rather than technical troubleshooting. While IT can work in parallel to discuss technical actions, the primary emphasis is on how management handles the business, communications, and recovery challenges created by the incident.

This exercise challenges health care leaders to make decisions under pressure during a fast-moving cyber event that affects systems, staff confidence, continuity of care, and day-to-day operations.

Why This Scenario Matters for Health Care Facilities

Health care facilities depend on technology, communications, and uninterrupted access to critical information to support patient care, staffing coordination, and safe operations. A cyber incident can quickly disrupt multiple functions at once while also creating compliance, privacy, and continuity concerns.

This exercise helps leadership teams evaluate how they would respond when a cyber-related disruption begins affecting systems, communications, and operations before the full scope of the incident is understood, especially in an environment where resident care cannot simply stop.

Exercise Objectives

• Evaluate leadership decision-making during a fast-moving cyber disruption.
• Discuss internal coordination between management, operations, communications, and IT.
• Review how the organization would communicate with staff, residents, families, vendors, and other stakeholders.
• Assess priorities for maintaining care delivery and critical business functions during a system disruption.
• Identify escalation thresholds and management actions during a developing cyber event.
• Strengthen business resumption planning for technology-driven disruptions in a care environment.

Typical Participants

• Executive leadership
• Operations management
• Information technology leadership
• Information security or cyber response personnel
• Communications or public affairs staff
• Compliance or privacy personnel
• Business continuity or crisis management team members

Exercise Format

Conduct-It-Yourself Tabletop Exercises are structured, discussion-based simulations designed to help organizations test their response to disruptive events without the time and cost of a fully facilitated exercise. Participants are placed in the middle of a realistic scenario as it unfolds and must work through decisions, priorities, and consequences as a leadership team.

Each downloadable exercise package includes everything needed to conduct the session internally, including facilitator instructions, exercise overview materials, participant forms, a detailed scenario script, and a ready-to-run PowerPoint presentation that guides the scenario and discussion. The materials are designed so organizations can conduct the exercise as delivered or customize the storyline and supporting materials to reflect their own facilities, operations, and testing objectives.

Most exercises are designed to be conducted in approximately 2 to 4 hours. A typical agenda includes an exercise overview and scenario briefing, the facilitated disaster simulation discussion, group review and preparation for debriefing, and a structured post-exercise discussion to capture lessons learned and improvement opportunities.

Exercise Focus

• Crisis Management
• Communications
• Business Resumption

Related Tabletop Exercise Scenarios

Organizations exploring this scenario may also find these exercises useful:

• Multiple Disruptions Tabletop Exercise for Health Care Facilities
• Workplace Hostage Tabletop Exercise for Health Care Facilities
• Gas Main Explosion Tabletop Exercise for Health Care Facilities
• Shelter-in-Place Tabletop Exercise for Health Care Facilities

Purchase & Download

This exercise is delivered as a downloadable package that includes facilitator instructions, scenario materials, and structured discussion prompts to guide the exercise.