Degraded-Mode Operations and Manual Workarounds Guide: Keeping Critical Services Running Without IT

When ransomware or a defensive shutdown takes core systems away for weeks, the organisations that keep serving customers are the ones that planned and practised how to work without them. Disaster recovery plans assume systems come back within a recovery time objective; recent incidents show that whole estates can be unavailable for months. This guide covers degraded-mode operations: deciding the minimum viable company, designing manual and paper workarounds, pre-printed forms, offline access to credentials and documents, and how to switch back without losing data. It is for business continuity leads, service owners, CISOs and executives. Restoring technology is covered in the Ransomware Response and Recovery Guide and the Business Continuity and Disaster Recovery Guide, and is not repeated here.

Key takeaways

• Plan for weeks, not hours. The British Library's online catalogue returned in mid-January 2024 after an attack discovered on 28 October 2023, and Synnovis took until late autumn 2024 to restore services after the 3 June 2024 attack.
• Define the minimum viable company first. List the handful of services that must continue, the tolerable level of each, and what they actually depend on, including identity, printing, payments and phones.
• Manual processes must be capacity-tested. Paper is slower: south east London pathology ran at 45% then 54% of pre-attack capacity in the weeks after the Synnovis attack, which forced explicit prioritisation of urgent work.
• Offline means offline. Plans, contact lists, network documentation and break-glass credentials that live only on the encrypted file share or in the compromised password vault are not available when you need them.
• Back-entry is part of the workaround. Every paper transaction must be reconciled into the restored system, so design forms and logs for data re-entry from the start.

What degraded mode is and why it is different from DR

Disaster recovery restores technology. Degraded-mode operations keep the business running at a reduced but acceptable level while technology is unavailable, and in a cyber incident that period is set by the investigation and clean rebuild, not by restore speed. Ransomware actors deliberately attack recovery: MITRE ATT&CK lists Data Encrypted for Impact (T1486), Inhibit System Recovery (T1490), Data Destruction (T1485) and Service Stop (T1489) as impact techniques. The British Library's review records that its main library services platform could not be restored in its pre-attack form at all.

Degraded mode is also triggered by your own decisions. Jaguar Land Rover shut down its network at the end of August 2025 and production stayed paused for more than five weeks. Co-op took parts of its IT offline on 30 April 2025 as a proactive measure, which disrupted back-office and customer support operations. Change Healthcare disconnected its systems to contain the 2024 attack, and claims, eligibility checks and pharmacy payments across the US were disrupted for weeks.

Defining the minimum viable company

The minimum viable company is the smallest set of services, people and technology the organisation needs to meet its legal, safety and financial obligations while recovering. CISA's ransomware guide asks organisations to know which data or systems are most critical for health and safety, revenue generation or other critical services, and to prioritise restoration from a predefined critical asset list. ISO 22301:2019 provides the business impact analysis method for setting tolerances.

1. List prioritised services: start from the services customers, patients or regulators depend on (CSF 2.0 GV.OC-04). Most organisations end up with five to fifteen.
2. Set a tolerance for each: the maximum tolerable period of disruption and the minimum acceptable level, for example "urgent blood tests within 4 hours" rather than "pathology available".
3. Map hidden dependencies: identity (Active Directory, SSO, MFA), DNS and DHCP, printing, telephony, payments, label and barcode printers, building access, payroll, and the supplier systems behind each service.
4. Mark what survives: the British Library found that cloud-based email, finance, HR and payroll, and the building security systems, kept working while on-premises systems were destroyed. Know in advance which of your services sit outside the likely blast radius, and which share its identity.
5. Choose a degraded method for each service: manual, alternate system, supplier or partner, or deliberately suspend.
6. Record the restart order: it should follow the minimum viable company, not the server list.

Designing manual workarounds

Pre-printed forms and procedures

• Design for re-entry: forms should mirror the fields of the system they replace, in the same order, with mandatory fields marked, so data can be keyed back in quickly.
• Use unique serial numbers: pre-numbered forms let you prove completeness during reconciliation and spot missing transactions.
• Print by site: store a sealed degraded-mode pack at each site: forms, procedures, contact lists, emergency stock of consumables such as labels and receipt rolls, and a list of what to do first.
• Version and refresh: reissue packs on a schedule (quarterly for contact lists, after any process change for procedures) and record the version on each sheet.
• Keep them short: a one-page action card per role beats a 60-page BCP nobody reads under pressure.

Prioritisation and triage

Manual processes cut throughput, so demand must be cut too. In the weeks after the Synnovis attack, NHS England reported that only urgent GP referrals were accepted for blood sciences, that blood tests were prioritised for the most critical cases, and that mutual aid between London NHS organisations was used to limit disruption. By 7 July 2024, 6,199 acute outpatient appointments and 1,491 elective procedures had been postponed at the two affected trusts, according to NHS England's (unvalidated) figures, and hospitals were using more O type blood than usual, prompting an NHS Blood and Transplant donor appeal. Decide in advance which work stops, who decides, and how customers are told.

Offline access: documents, data and credentials

CISA advises keeping a hard copy and an offline version of the incident response plan, and storing asset and network documentation with offline backups and physical hard copies. The NCSC advises keeping contact details available for when computer systems are lost, keeping offline backups disconnected from the network and connecting them only to known clean devices.

• Offline document set: degraded-mode procedures, network diagrams, IP plans, firewall rules, recovery runbooks, supplier contracts and contacts, insurance policy, and the minimum viable company list. Store printed copies and an encrypted copy on removable media in at least two locations.
• Offline data extracts: for some services, a regular read-only export (customer list, open orders, patient appointments, staff rota) is what makes manual working possible. Treat extracts as sensitive data: encrypt them, limit holders and record where they are.
• Clean devices: keep a small stock of standalone laptops and phones, not domain-joined and not enrolled in the corporate management tool, with offline office software and printer drivers.

Break-glass credentials

The identity layer is usually the first thing lost and the last thing trusted. Microsoft's emergency access guidance for Entra ID recommends at least two cloud-only accounts on the .onmicrosoft.com domain, phishing-resistant authentication with passkeys (FIDO2) or certificate-based authentication, exclusion from Conditional Access policies that could block sign-in, credentials stored in fireproof safes in separate locations, a critical alert on any sign-in, and validation at least every 90 days. Apply the same thinking to on-premises Active Directory, hypervisors, backup consoles, network devices and the bank portal.

Do not keep the only copy of these in the corporate password vault if that vault depends on the domain you are trying to recover. See the Break-Glass Account Guide and the Backup Identity Isolation Guide.

Running degraded mode: roles and control

• Invocation: the crisis team decides when to enter degraded mode and for which services. See the Crisis Management Guide for command and decision rights.
• Service owners run it: each prioritised service has an owner who runs the manual process, reports throughput and backlog daily, and escalates when tolerance is at risk.
• Keep security controls in the manual world: paper is a fraud opportunity. Keep segregation of duties and dual authorisation for payments, call back on known numbers for any change of bank details, and log who handled each form (NIST SP 800-53 CP-13 alternative security mechanisms). See the Fraud Prevention Guide for Digital Businesses.
• Protect personal data on paper: lockable storage, clear-desk rules, controlled courier routes and a disposal process. The UK GDPR still applies to paper records.
• No shadow IT without a decision: staff will reach for personal email and free cloud tools. Approve a small set of interim tools explicitly, record them, and bring the data back under control during recovery.
• Look after people: manual working is tiring. The British Library listed staff and user wellbeing among its lessons and noted that staff followed more demanding manual processes.

Switching back: reconciliation and back-entry

1. Set restart criteria: a service returns only when the rebuilt system is clean, its identities and service accounts have been reset, and monitoring is in place. See the Incident Response Guide.
2. Freeze the paper: agree a cut-over time per service; after it, new transactions go to the system and paper stops.
3. Back-enter in serial order: key paper records by form number, with a second person checking a sample, and reconcile totals (orders, payments, stock movements) against manual control logs.
4. Validate restored data: CSF 2.0 RC.RP-03 asks that backups and restoration assets are verified before use. The British Library notes each digital dataset had to be validated before restoration.
5. Run in parallel briefly: for high-risk services, keep the manual control running alongside the system for a few days to catch errors.
6. Close out: retain the paper under the records policy, destroy surplus extracts securely, and feed lessons into the next pack version.

Testing degraded mode

The British Library's review lists regular practice of business continuity arrangements for total system outage among its lessons. The NCSC suggests exercising how long it takes to restore minimum devices and to rebuild from offline backups. Practical tests:

• Walk-through: each service owner talks through the action card with the team, using the real forms. Fix gaps the same day.
• Timed manual shift: one site or team runs a full shift on paper, and throughput is measured against the tolerance.
• Back-entry drill: key a day's worth of paper back into a test system and measure time and error rate.
• Credential drill: open the safe, use each break-glass credential, record the result, reseal and rotate.
• Combined scenario: run with the Tabletop Exercise Guide approach, with injects that remove identity, email and printing at once.

Detection and measurement

Degraded mode is entered because detection fired or a decision was taken, so the monitoring that matters is about readiness and, during an incident, about throughput and control. Log every break-glass sign-in with a critical alert, as Microsoft recommends, and review each use afterwards. Track:

• Coverage: percentage of prioritised services with a tested degraded method and a current pack at every site (target 100%).
• Degraded capacity: measured throughput in manual mode as a percentage of normal, per service, from the last timed shift.
• Time to degraded mode: minutes from invocation to the first manual transaction completed.
• Back-entry error rate: errors per 100 records in the last drill or real reconciliation.
• Break-glass validation: percentage of emergency credentials tested in the last 90 days.
• Pack currency: age of the oldest contact list or procedure in circulation.

Framework mapping

Common failure patterns

• The plan is on the encrypted share: the BCP, contact list and network diagrams were stored on the systems that went down. Keep printed and offline copies at every site.
• Workarounds depend on the lost identity: the "manual" process needs a login to the same domain, or the surviving SaaS signs in through the compromised SSO. Map identity as a dependency of every workaround.
• Planned for 72 hours: stock of forms, consumables and staff stamina runs out in week one. Plan for at least four weeks, informed by the British Library, Synnovis and Jaguar Land Rover timelines.
• Nobody tested the capacity: the paper process works for ten transactions and fails at a thousand. Time it, then plan triage for the gap.
• Supply chain forgotten: suppliers and customers who depend on your systems stop too. The Cyber Monitoring Centre estimated more than 5,000 UK organisations were affected by the Jaguar Land Rover shutdown. See the Jaguar Land Rover cyberattack 2025.
• Back-entry ignored: weeks of paper with no serial numbers or control totals cannot be reconciled, and errors surface months later.

Lessons from incidents

• British Library, 2023 (own review): buildings, exhibitions and events continued because cloud finance, HR and payroll and building security survived, while research services ran at reduced capacity with Reading Room access at about half normal volume and enquiries handled by email, phone and in person.
• Synnovis and south east London NHS, 2024 (NHS England updates): prioritisation of urgent tests, mutual aid between organisations and a blood donor appeal kept urgent and emergency care open while pathology capacity was around half of normal.
• Change Healthcare, 2024: containment by disconnection pushed degraded mode onto thousands of customers who had no workaround for claims and pharmacy payments, a reminder to plan for the loss of a critical supplier as well as your own systems. See the Change Healthcare breach 2024.
• Co-op, 2025: a proactive shutdown disrupted back-office and customer support operations, and empty shelves were reported. See the Co-op cyber attack 2025.

Practitioner checklist

• Agree the minimum viable company: prioritised services, tolerances and named owners.
• Map each service's dependencies, including identity, printing, telephony, payments and suppliers.
• Write a one-page degraded-mode action card per role and service.
• Design serial-numbered forms that mirror system fields, and stock sealed packs at every site.
• Keep printed and offline copies of plans, contacts, network documentation and recovery runbooks in at least two locations.
• Provision break-glass credentials for cloud, directory, backup, hypervisor, network and banking, stored offline and tested every 90 days.
• Pre-agree triage rules: which work stops, who decides and how customers are told.
• Keep dual authorisation and call-back checks for payments while on paper.
• Run a timed manual shift and a back-entry drill at least annually per prioritised service.
• Define restart criteria, cut-over and reconciliation steps for every service.

Standards and references

• ISO: ISO 22301:2019 Security and resilience, Business continuity management systems, Requirements
• CISA: #StopRansomware Guide
• NCSC: Mitigating malware and ransomware attacks
• Microsoft Learn: Manage emergency access admin accounts in Microsoft Entra ID
• British Library: Learning Lessons from the Cyber-Attack, Cyber Incident Review
• NHS England: Update on cyber incident clinical impact in south east London, 11 July
• Synnovis: Cyber incident update
• MITRE ATT&CK: Inhibit System Recovery

Related NHI Mgmt Group resources: Business Continuity and Disaster Recovery Guide · Ransomware Response and Recovery Guide · Incident Response Guide · Crisis Management Guide · OT Incident Response Guide