A backup that had never been restored

The restore test came first

Before changing anything, we tried to restore from the backups.

The nightly job had reported success for four years. It had been copying the database files without the transaction logs, so not one of those backups could be restored to a working state. They existed, and they were useless.

This is not rare. It is the single most common serious finding in our assessments, and it is invisible until someone tries.

Fixing the shared logins by removing the reason

Reception staff shared a login. Not out of carelessness: logging in individually took too long, dozens of times a shift, with a patient waiting.

We did not run an awareness session. We put badge readers on the workstations with session roaming, so a clinician's desktop follows them and authentication takes under two seconds.

Shared logins disappeared within a week, because the workaround stopped being worth the effort. Policy without workflow change would have achieved nothing.

A rehearsed downtime procedure

The recovery time we quote, 90 minutes, is one we measured in a rehearsal, not one we worked out from a datasheet.

The rehearsal also produced the parts nobody thinks about: which forms staff need on paper, where they are kept, who calls whom, and in what order systems come back. Then we drilled it with clinical staff, which found two wrong assumptions in our own document.

What is still open

The group runs one clinical application that only supports authentication we would rather not rely on. We have documented the risk, compensated with network controls, and it is on the roadmap with the vendor. We are noting it here so nobody reads this as a finished estate.