Disaster Recovery Exercises in Ukraine: Testing Resilience Under War Conditions

The difference between a disaster recovery plan and a disaster recovery capability is testing. Documented procedures that have never been executed will fail in predictable ways at the worst possible moment: missing dependent steps, outdated contact information, incompatible restored configurations, and untrained personnel who have never seen the process before. Ukraine's wartime experience has converted disaster recovery testing from a periodic compliance requirement into a continuous operational imperative, with lessons learned in exercises preventing failures in real-world recovery operations.

National-Level DR Exercise Framework

Ukraine's national-level disaster recovery exercise program, coordinated by SSSCIP with participation from all critical sector regulators, follows a tiered structure: tabletop exercises (discussion-based scenario walkthroughs), functional exercises (operational teams executing specific DR procedures without full system recovery), and full-scale exercises (complete system recovery tests including backup restoration, failover, and service validation). The 2023 and 2024 national exercise cycles incorporated real-world attack scenarios drawn from CERT-UA incident data, making exercises directly relevant to the threat environment rather than hypothetical.

National exercises are coordinated with international partners—ENISA observes and contributes to exercise design, NATO CCDCOE provides facilitators for cyber-specific scenarios, and bilateral exercises with US and UK cyber commands include elements testing cross-border coordination between Ukrainian and allied response teams. Exercise findings are classified as Confidential but aggregated, anonymized lessons are shared with the international partner community to benefit allied resilience programs.

Sector-Specific DR Testing Programs

The energy sector's DR testing program is the most mature, partly because real-world attack experience in 2022–2023 generated detailed incident after-action reports that directly informed exercise scenarios. Ukrenergo conducts quarterly functional DR exercises for its transmission system; regional distribution operators conduct semi-annual exercises at minimum. The energy exercises specifically test restoration sequence—which systems must come back online in what order to safely restart generation and distribution—a procedural complexity that has no equivalent in purely IT recovery contexts.

The water sector DR testing program, supported by WHO technical assistance, focuses on scenarios where both SCADA systems and communications infrastructure are simultaneously unavailable—a scenario directly drawn from attacks on water utilities in 2022. Manual operation fallback procedures, which require physical presence at treatment facilities and experience operating without SCADA visibility, are specifically tested because automation dependency had reduced familiarity with manual procedures among operational staff.

DR Exercise Results by Sector (2023–2024)

Key Findings and Improvements

Consistent findings across sectors included: documentation gaps (recovery procedures referenced systems or contacts that no longer existed), decision authority ambiguity (unclear who could authorize major recovery decisions outside business hours), personnel capability gaps (staff not trained on manual fallback procedures), and vendor dependency risks (recovery procedures required vendor support that might not be available during the specific type of crisis being exercised).

Improvements implemented following 2023 exercises included mandatory semi-annual documentation reviews to synchronize recovery procedures with current system configurations, pre-authorization matrices defining who can approve specific recovery actions at each time of day and day of week, cross-training programs for manual operations, and establishment of emergency vendor support agreements with defined availability commitments for attack scenarios.

Real-World Validation of Exercise Investments

The clearest validation of DR exercise investment came during actual 2023–2024 attack responses, where organizations that had conducted formal exercises reached recovery milestones faster than those relying on untested plans. SSSCIP reports that energy sector facilities that had completed the 2023 full-scale exercise series recovered from SCADA disruption incidents in approximately 40% less time than facilities that had only conducted tabletop exercises without functional testing—a measurable operational benefit from exercise investment.

FAQ

What is the difference between a tabletop and full-scale DR exercise?

A tabletop exercise is a discussion-based walkthrough where participants describe what they would do—no systems are actually failed over or recovered. A full-scale exercise actually executes recovery procedures, including restoring from backups and validating that recovered systems function correctly. Full-scale exercises reveal practical failures that tabletops miss.

How does wartime affect the logistics of running DR exercises?

Air raid warnings interrupt exercises, key personnel may be unavailable due to mobilization, damaged communications affect coordination, and physically traveling to exercise sites in certain areas carries safety risks. Ukraine's exercise program has adapted through shorter more frequent exercises, remote participation where on-site presence is unsafe, and exercise scheduling that avoids peak attack periods where possible.

Why does manual operation training matter for water sector DR?

Modern water treatment relies on SCADA automation. Staff trained only on automated operations may not be able to manually control chemical dosing, pumping, and filtration if SCADA is unavailable. During 2022 attacks, some water facilities struggled with manual operation because staff had never needed to use it during their operational careers.

Who facilitates Ukraine's national-level DR exercises?

SSSCIP coordinates national exercises with sector regulators. International facilitators from ENISA, NATO CCDCOE, and allied national organizations contribute exercise design and evaluation expertise. For cyber-specific DR exercises, CERT-UA provides scenario development based on real incident data.

How often must Ukrainian critical infrastructure operators test DR procedures?

SSSCIP and sector regulators mandate frequencies varying by sector: energy sector Tier-1 operators must conduct functional exercises quarterly. Other sectors require semi-annual or annual functional testing minimums, with tabletop exercises as more frequent supplementary activities.

Sources

1. SSSCIP Ukraine — "National Critical Infrastructure DR Exercise Program: 2023–2024 Annual Report"
2. NATO CCDCOE — "Cyber Crisis Exercise Support for Ukraine: Methodology and Outcomes," 2024
3. Ukrenergo — "Transmission System Disaster Recovery Testing Program," internal summary 2024
4. WHO Ukraine — "Water Sector Resilience and DR Exercise Program," 2023
5. ENISA — "Good Practices for National Cyber Crisis Management Exercises," 2023