Cybersecurity

Run Your Villages Business's Hurricane IT Tabletop Exercise — The 90-Minute Pre-Season Drill for Sumter, Lake, and Marion County Operators

May 18, 20268 min readSteve Condit — Founder, Simply IT

Cybersecurity

The Villages is inland, sits at roughly 60 feet of elevation, and almost never sees the same direct surge damage that hits the coasts — which is exactly why most Villages business owners under-prepare for hurricane season. The threats that actually take a Villages medical, dental, legal, or retail operation offline are different from the ones an Anna Maria Island shop worries about: extended power loss on the Sumter / Lake / Marion grid, internet circuit outages that cascade across the 3-county footprint, employee evacuation patterns that drain your staffing for 5-10 days, and a senior patient/customer base that needs proactive, channel-appropriate notification when service is degraded. The 90-minute tabletop drill below is the one we run with our Villages clients every May. It surfaces the gaps in your plan before the storm does. For the full continuity framework, start with our Villages managed IT pillar guide, and for the broader statewide version of this drill see our Florida hurricane IT tabletop exercise post.

90 MIN

Pre-season tabletop drill

Scenarios to walk through

Roles to assign before storm

72 HR

Post-storm runbook horizon

Why a Villages Business Needs This Drill (Even Though You’re Inland)

Walk the last decade of named storms that affected Sumter, Lake, and Marion counties and the pattern is consistent. The wind damage rarely takes a building. The grid takes 36-96 hours to recover in pockets. The Spectrum and Comcast trunks across the 3-county footprint have gone down for stretches measured in days. Generator fuel deliveries get prioritized to hospitals and life-safety facilities — a dental office or law firm is days 4-5 on the priority list at best. And the most underrated factor in The Villages specifically: your staff lives where your clients live. When evacuation orders go out for adjoining coastal counties, family members of your Villages-resident staff start showing up. When power is out at the staff member’s daughter’s house in Inverness or Crystal River, that staff member is not coming to work tomorrow. Operational continuity in The Villages is a staffing problem at least as much as it is a technology problem — and the tabletop has to surface both.

The 4 Roles to Assign Before You Start

Don’t run a tabletop with “everyone in the room talks at once.” Pre-assign these four roles, give each one a one-page brief 24 hours in advance, then walk the scenarios in order:

Incident Commander: Usually the owner or managing partner. Makes the go/no-go calls (close the office, move to remote work, cancel patient appointments). Authorized to spend up to a pre-agreed dollar amount on emergency response without a second sign-off.
Technology Lead: Your office manager or designated tech-point if you have one, your MSP’s on-call contact if you don’t. Owns dual-WAN failover, generator startup, cloud-cutover credentials, and post-storm system verification.
Communications Lead: The person who calls patients, clients, employees, and suppliers. For senior-heavy Villages businesses this role matters more than it does anywhere else — a 76-year-old patient does not check Facebook for the “we’re closed today” post.
Documentation Lead: One person, one phone, one folder. Photographs damage, captures timestamps, logs every vendor call, saves every text. This person’s output is what feeds the insurance claim and any HIPAA / Bar / FTC documentation downstream.

The 6 Scenarios to Walk Through

Each scenario gets 10-15 minutes of focused discussion. The goal isn’t to solve the scenario perfectly — it’s to identify the 1-3 gaps that need real work before June 1.

Power loss + dual-WAN failover (hour 2 of an outage)

Sumter Electric or Duke Energy is dark across half your office’s zip code. Your UPS bought you 15 minutes of uptime. Walk through: who plugs in the generator, where are the generator-fed circuits actually wired, does the Spectrum modem ride on the generator (most don’t by default), does your Cradlepoint or Peplink failover to LTE on its own, does VoIP keep working when the LAN switches to LTE, do credit card terminals reach the processor over the failover circuit.

Office physically damaged + remote-work cutover (hour 24)

A tree took out the front window. Drywall is wet. The office is uninhabitable for 5-10 days. Walk through: do all clinical / legal / production staff have laptops they can take home (or do they share desktops in the office), is your phone system cloud-based or does it depend on the in-office PBX, can your EHR / practice management / case management system be reached from a home network, does every employee’s home Wi-Fi actually support what you’re asking them to do, where do you meet patients/clients if you need to during the displacement.

Generator runs out of fuel day 2 (hour 36)

Power is still out. Your generator burned through its tank overnight. Fuel deliveries are prioritized to hospitals, nursing homes, and Villages-area life-safety facilities. Walk through: who is your fuel vendor on file, is there a pre-storm contract or are you on the spot-market list, how many hours of runtime do you actually have, what do you shut down first to extend runtime, when do you make the call to close vs. partial-operate.

Cyber attacker exploits the chaos (hour 48)

Your team is exhausted. An email lands looking like it’s from your insurance adjuster asking for ACH info to expedite the claim. A second email looks like it’s from your bank confirming a fraudulent wire. A third ‘Microsoft’ pop-up appears on a staff member’s home laptop. Walk through: who has authority to authorize emergency wires during a storm event, what’s the out-of-band verification process for any unusual financial request, has staff been briefed that BEC attacks spike during named storms (they do, every year), and is your EDR / MFA still functioning while team is on home networks.

Employee uses personal device with no MDM (hour 60)

A staff member’s work laptop won’t come back to life. She switches to her personal iPad to keep up with patient/client messages. Walk through: is that personal device touching PHI / client confidential information without MDM enrollment, is there a documented temporary-device protocol, can you remotely wipe what gets stored, what does this look like to an OCR investigator (medical) or Bar grievance committee (legal) if the device is lost.

Insurance claim documentation (hour 72)

Power’s back. Internet is intermittent. Now the cleanup and claim begin. Walk through: do you have pre-storm photos of every room and the IT closet, are device serial numbers in an asset inventory the adjuster can read, did the Documentation Lead capture timestamps and vendor calls, do you have receipts for emergency labor and equipment, and most importantly — is your business interruption coverage actually written to pay during a named storm in your zip code.

“The Villages businesses that ride out a storm well aren’t the ones with the biggest generators. They’re the ones whose owner spent 90 minutes in May actually walking the scenarios with the team.”

Steve Condit, Simply IT

Villages-Specific Considerations Other Drills Miss

A generic Florida hurricane drill won’t cover these. Add them to your tabletop or you will be the one figuring them out in real time:

Senior-patient / senior-client notification cadence: Email gets ignored. Facebook gets ignored. A pre-recorded phone call to the patient’s home number, sent through your practice management system or a tool like CallEm-All, is what actually reaches the 70+ demographic. Build the recorded-call workflow in May, not in August. Have a script written, a phone tree assigned, and a vendor account that’s already been tested.
AHJ approval for life-safety phones: Lake County, Sumter County, and Marion County fire marshals have different positions on POTS-line replacements feeding alarm panels and elevator phones. If you have a building with elevators or alarm dialers, your fire marshal’s signoff on the cellular or VoIP-with-battery-backup replacement needs to be in your storm folder. We’ve seen Villages-area buildings re-shut after a storm because the fire marshal couldn’t confirm the life-safety phone was operational on backup power. See our POTS line replacement options guide for the AHJ paperwork specifics.
FPL / Duke / SECO outage history for your specific block: The grid varies dramatically inside the Villages footprint. Brownwood Paddock differs from Spanish Springs differs from Lake Sumter Landing. Pull the 5-year outage history for your actual address before storm season. If your block is on a circuit that historically takes 60+ hours to restore, your generator-fuel math changes.
Supplier disruption from coastal counties: Your dental supplier may be based in Tampa. Your printer toner comes out of Orlando. Your patient gowns ship from Jacksonville. If those counties take a direct hit, your supply chain is the operational constraint, not your office. Map the top 5 suppliers by address before the storm and have a secondary identified.
Staff with second homes — out-of-area family loops: A meaningful percentage of Villages-area staff have grown children in Tampa Bay, the panhandle, or the Carolinas. When the storm tracks toward those areas, you lose those staff members to family travel before any local impact. Plan staffing around it.

// The Mistake We See Every Year

The single most common Villages-area mistake: a business owner who thinks “we’re inland, we’re fine” right up until the moment a generator won’t start, the M365 admin password is on a sticky note in the locked office, and nobody knows which staff member has the spare modem. The drill costs 90 minutes in May. Skipping it costs 7-14 days of revenue and trust when the storm actually comes. Run the drill.

The 72-Hour Post-Storm Runbook

The drill should end with everyone reviewing the post-storm runbook. Here’s the framework we use with Villages clients:

Hour 0-12 (storm passing / immediate aftermath): Account for every staff member. Confirm building safety. Document any damage before cleanup. Verify generator status. Do not enter the building until structural safety is confirmed by the AHJ for major damage.
Hour 12-24 (assess and notify): Send the pre-recorded notification call to patients/clients. Update the website and Google Business Profile. Notify your MSP, your cyber insurer, and your business interruption insurer in writing. Begin the documented vendor-call log.
Hour 24-48 (partial operations): Bring systems online in priority order — clinical / case-management first, billing second, marketing third. Verify backups completed during the outage window. Run security checks on any device that was on a home network during the storm.
Hour 48-72 (return to normal): Reopen the office once power, internet, HVAC, and life-safety systems are confirmed operational. Run a debrief with the team within 7 days while the lessons are fresh.

// Key Takeaway

The Villages doesn’t experience hurricanes the same way the coasts do — and that’s precisely why most Villages businesses are under-prepared. The 90-minute pre-season tabletop drill, the 4 named roles, the 6 scenarios, and the documented 72-hour post-storm runbook are the smallest possible investment that meaningfully changes your continuity outcome. Block 90 minutes on a May afternoon, gather the team, walk the scenarios, write down the gaps, and assign owners with due dates before June 1.

Read the Villages Managed IT Pillar Guide →

// Written By

STEVE CONDIT

Founder & Owner, Simply IT · US Marine Veteran · 30+ Years IT Experience

Steve Condit founded Simply IT to bring enterprise-grade IT management to small and mid-sized businesses across North Central Florida. With over 30 years of IT experience and a background in the US Marine Corps, Steve built Simply IT around the principle that local businesses deserve the same quality of technology partnership that large companies take for granted — without long-term contracts or national call center support.

Full Bio →LinkedIn →About Simply IT →