When DireWolf stole 253 gigabytes from the National Kidney Registry in August 2026, the attack didn't encrypt systems or halt operations. But that distinction matters less than you'd think. If your organization depends on a supplier that coordinates time-sensitive, life-saving services, you need a tested plan for what happens when their systems go dark, whether from ransomware, data theft, or infrastructure failure.
This playbook provides a template for identifying critical suppliers with no substitutes and building the manual workflows that keep care moving when digital coordination stops.
Purpose of This Playbook
Use this template to:
- Map suppliers where operational disruption creates immediate patient safety risk.
- Document alternate communication and coordination paths before an incident.
- Build manual workflows that clinical and supply chain teams can execute without digital systems.
- Test those workflows with named contacts at both organizations.
This isn't a vendor risk assessment questionnaire. It's a continuity plan for scenarios where your supplier's IT goes offline and you still need to coordinate transplants, blood products, specialty medications, or urgent diagnostics.
Prerequisites
Before you start:
- Authority to Act: Confirm who on your team has decision-making authority during a supplier outage (typically clinical leadership, supply chain director, and IT/security).
- Supplier Access: You'll need direct contact with operational leads at each critical supplier, not just procurement or compliance contacts.
- Clinical Input: Involve clinical staff who use these services daily. They'll identify workflow gaps you won't see from a risk management desk.
The Playbook Template
Section 1: Critical Supplier Identification
For each supplier, answer:
Supplier Name:
Service Provided:
Clinical Impact if Unavailable: (Be specific: "Delays kidney transplant matching" not "impacts patient care")
Substitute Available: Yes / No
Days of Local Inventory or Buffer: (If applicable)
If No Substitute Exists:
- What's the maximum acceptable outage duration before patient harm becomes likely?
- What manual process existed before digital coordination? (Many organ procurement organizations had paper-based workflows pre-2000s.)
- Who at the supplier has authority to accept manual requests?
Section 2: Alternate Communication Matrix
Build this table for each no-substitute supplier:
| Contact Role | Name | Direct Phone | Personal Email | Backup Contact |
|---|---|---|---|---|
| Primary Operational Lead | ||||
| After-Hours Contact | ||||
| Executive Escalation | ||||
| Your Organization's Point Person |
Critical: These contacts must be stored offline. If the supplier's email and phone systems are compromised, you need personal cell numbers and non-corporate email addresses.
Section 3: Manual Workflow Documentation
For each critical supplier, document the step-by-step manual process:
Scenario: [Supplier name]'s digital systems are unavailable for [service type]
Step 1: Notification and Confirmation
- How will you learn the supplier's systems are down? (Don't assume they'll notify you.)
- How will you confirm whether they can accept manual requests?
- Who initiates contact from your side?
Step 2: Request Submission
- What information must you provide? (For transplant coordination: recipient ID, blood type, HLA typing, urgency level, contact surgeon.)
- What format? (Fax, encrypted email to personal address, phone call with verbal confirmation.)
- What confirmation do you receive that the request was logged?
Step 3: Status Updates
- How often will you check status?
- Who provides updates from the supplier side?
- What triggers an escalation?
Step 4: Completion and Handoff
- How will the supplier notify you when coordination is complete?
- What information transfers back to your systems once they're restored?
- Who verifies nothing was missed during the manual period?
Step 5: Return to Normal Operations
- What's the trigger to resume digital workflows?
- How do you reconcile manual records with restored systems?
Section 4: Exercise Plan
Document your testing schedule:
Tabletop Exercise (Quarterly):
- Scenario: [Supplier] reports ransomware attack, systems offline for 72 hours.
- Participants: Clinical lead, supply chain director, IT/security, supplier operational contact.
- Test: Can both teams execute the manual workflow using only the offline contact list?
- Duration: 60 minutes.
- Documentation: What worked, what failed, what contacts were outdated.
Full Simulation (Annually):
- Execute an actual manual request through the alternate workflow.
- Involve real clinical staff, not just leadership.
- Measure: Time to complete vs. digital baseline, points of confusion, missing information.
- Update playbook based on findings.
Customization Options
For Blood Suppliers:
Focus Section 3 on how you'd receive emergency blood products if the supplier's inventory management and delivery coordination systems were offline. Include backup transportation arrangements and bedside testing protocols if electronic crossmatch isn't available.
For Specialty Medication Suppliers:
Add a subsection on which medications you can safely substitute vs. which require the exact formulation. Document how you'd verify dosing and contraindications without access to the supplier's clinical decision support tools.
For Diagnostic Labs:
Detail how you'd submit urgent specimens and receive critical results (sepsis panels, transplant monitoring, oncology markers) using phone, fax, or courier with paper requisitions.
For Organ Procurement Organizations:
This template maps directly. The National Kidney Registry incident shows that even data theft without encryption creates coordination risk. If the organization can't trust its matching algorithms or donor records, they may halt operations voluntarily.
Validation Steps
Before You File This Playbook:
Contact Verification (Monthly): Call each supplier contact on your matrix. If you reach voicemail or a disconnected number, update immediately.
Clinical Review: Have a clinical staff member who uses this service review Section 3. Ask: "If you had to do this manually tomorrow, would these steps work?"
Supplier Confirmation: Send your documented manual workflow to the supplier's operational lead. Ask them to confirm they can support it during an outage. Get written acknowledgment.
Authority Check: Confirm your named decision-makers still have authority. Organizational changes can invalidate your escalation paths.
Contractual Alignment: Review your supplier agreements. Do they require the supplier to notify you within a specific timeframe of a cyber incident? Do they commit to maintaining alternate communication channels? If not, negotiate those terms at renewal.
After Your First Exercise:
Compare your documented workflow against what actually happened during the tabletop. If your team couldn't locate contact information, couldn't agree on who had authority, or discovered the supplier's manual process differs from what you documented, you've found your gaps.
Update the playbook before the next exercise. The goal isn't a perfect document; it's a tested process that works when systems fail.
The National Kidney Registry attack didn't halt transplants, but the next incident might. Your resilience depends on having named contacts, documented workflows, and tested procedures before a supplier's systems go dark. Build this playbook now, while you still have time to find the gaps.
