Four Hours in the Dark: A Tabletop Drill for Compound Infrastructure Failure

Most disaster recovery plans are written for a single failure. A server goes down, a region becomes unavailable, a broadband line drops. Real incidents are less polite. They arrive in combinations, at the worst moment, and they test the parts of the organisation that no runbook owns.

The four-hour blackout test is a tabletop drill for that compound scenario. It simulates the loss of broadband, power, a cloud region and the identity provider at the same time. The aim is not to prove that systems fail. It is to prove that people can make decisions, communicate and keep a minimum service running when the familiar tools are gone.

Why a tabletop beats another document

A tabletop exercise is cheap, repeatable and safe. It does not require taking production systems offline or persuading every team to give up a Saturday. It does require a facilitator, a realistic scenario and the right people in the room: operations, IT, security, finance, customer service, communications and a senior decision-maker with authority to invoke manual fallbacks.

The output is not a new plan. It is evidence: a decision log, a timeline, a list of workarounds that failed and an agreed set of corrective actions. That evidence matters to a board, an insurer and, increasingly, to customers who ask how the organisation responds when its digital estate is degraded.

The scenario: four failures, one afternoon

Run the drill from 08:00 to 12:00. The facilitator injects the failures in a way that feels plausible rather than theatrical.

At 08:00, the primary broadband line fails. The secondary line is saturated within minutes. At 08:40, a power interruption affects the main office and the backup generator does not start as expected. At 09:20, the cloud region hosting the core platform becomes unavailable, and the status page updates slowly. At 10:00, the identity provider stops authenticating users, so single sign-on fails across remaining services.

Each inject should force a choice. Do staff move to a recovery site, go home or use mobile hotspots? Who authorises emergency spend? Which services are restored first, and which customers are told? What happens when the identity provider is unavailable and administrators need access to critical systems?

Manual fallbacks that are actually usable

A fallback that has never been tested is a hope. The drill should test the manual path, not just discuss it.

Start with access. Are there break-glass accounts, sealed credentials or offline authentication methods that work without the identity provider? Who can retrieve them, and how is that action logged? If the answer is a shared spreadsheet on the file server, the drill has already found a problem.

Then test communications. Mobile hotspots, analogue phones, printed call trees and a pre-agreed out-of-band channel should be available. The drill should reveal whether the call tree is current, whether voicemail works when the PBX is down and whether staff know which channel to use first.

Finally, test the business fallback. Can the team process orders, answer customers or maintain a minimum service on paper or in a local tool? Is there a pre-approved spend limit for emergency services? Are there manual workarounds that create data protection or financial control risks?

Decision rights and the communication tree

Compound failures create ambiguity. Two teams may invoke different plans, or no one may feel authorised to declare an incident. The drill should clarify who decides, who communicates and who can override normal change control.

Define an incident commander for the exercise. Give them authority to activate manual fallbacks, approve emergency spend within a stated limit and order service degradation. Name a deputy. Set thresholds for notifying the board, the DPO and key customers. A useful rule is to decide in advance what the organisation will say when it does not yet know the cause.

The communication tree should include internal staff, customers, suppliers, regulators where relevant and the insurer. Test the tree with a live call or message during the drill. A list of names is not a communication plan; a message that reaches the right person in ten minutes is.

Evidence the board and insurer will expect

After the exercise, produce a short assurance pack. It should include the scenario timeline, the decision log, the communication log, the services affected, the manual workarounds used, the financial and customer impact, and the corrective actions with owners and dates.

The pack should also record what the organisation could not do. That is often the most valuable section. If the identity provider failure left administrators unable to access the backup console, the board needs to know before a real outage. If the generator failed, the facilities team needs a maintenance action, not a paragraph in a lessons-learned document.

Use the NCSC exercise guidance as a reference for structure, but keep the pack proportionate. A two-page decision log with clear actions is more useful than a forty-page narrative that no one reads.

Running the drill without staging a crisis

A tabletop should be psychologically safe. Tell participants it is an exercise, set stop conditions, and avoid simulating actions that could affect live systems. Do not ask staff to switch off real power or disable real authentication. The point is to test judgement, not to create an incident.

Use an observer to capture timings and friction points. Debrief immediately after the four hours, while memories are fresh. Ask three questions: what did we assume that was wrong, what decision took too long, and what would we do differently in the first hour?

From exercise to assurance

The four-hour blackout test is not a one-off. Run it annually, rotate the scenario and invite a board observer. Track corrective actions to completion and report the results alongside other operational risks.

In 2026, resilience is less about having a plan and more about proving that people can operate without the tools they depend on. A four-hour drill will not eliminate compound failure, but it will show UK operations leads where the organisation is fragile, who can make decisions under pressure and what evidence they can give when the board or insurer asks how ready they really are.