Pre-hurricane DR tabletop: a guide for Puerto Rico teams
Tabletop scenarios: local datacenter down, AWS region degraded, staff dispersed post-storm.
Disaster recovery tabletop in November — before Atlantic hurricane season — should be annual ritual for Puerto Rico companies with digital dependence. CISA publishes adaptable exercises and inject cards; you do not need expensive consultants to facilitate a three-hour session with IT, operations, legal, and communications.
Base PR scenario: Category 3 storm impacts island, San Juan office without power 72h, 40% staff incommunicado, AWS us-east-1 operational but site-to-site VPN down. Who declares disaster? Activate RDS failover runbook? How serve mainland clients? Injects every 30 minutes complicate: "News reports flooding at local colo datacenter" or "Phishing exploits crisis with fake FEMA email."
Document gaps without blame: outdated runbook, obsolete AWS contacts, backups not tested since March. NIST SP 800-84 guides exercise programs — tabletop is low cost, high insight. Include critical vendors: ISP, hosting, MSSP — SLA during disaster?
Post-exercise: prioritized action items with owner and date. Tabletop without follow-up is theater. Condado and Isla Verde tourism companies have seasonal peak overlapping hurricane season — DR tabletop aligns technical and commercial continuity.
Staff dispersed post-storm in Orlando, Tampa, Dallas serving PR operations is post-Maria reality. Runbook must assume degraded communication — Signal, sat phone, offline contact tree. Tabletop reveals dependence on single leader; trained alternates are part of output.
Writes about practical cybersecurity for SMBs in Puerto Rico and the Caribbean — no fluff, just what actually needs to get done.
