Secure Isolated Recovery Environment (SIRE) Checklist: 5 Questions Every Healthcare CIO Should Ask

Healthcare IRE Self-Assessment Checklist

1. Is Your Recovery Environment Truly Isolated (Air-Gapped)?

• • Is it physically or logically separated from your production network?
  • Can it operate independently if your primary environment is compromised?
  • Are there strict controls preventing horizontal movement into the IRE?

Why it matters:
If your recovery environment isn’t isolated, ransomware can reach it—making recovery impossible when you need it most.

2. Are Identity and Access Controls Independent of Production?

• • Are authentication systems separate from Active Directory?
  • Do you enforce MFA and strict role-based access within the IRE?
  • Can administrators access the environment if core identity systems are down?

Why it matters:
Most attacks target identity first, why it’s the easiest. If your access controls are compromised, your recovery environment is too.

3. Are Your IRE Backups Immutable and Validated as Clean?

• • Are backups protected from modification or deletion?
  • Do you regularly verify that backups are clean and usable?
  • Can you confidently restore without reintroducing malware?

Why it matters:
Recovering infected or corrupted data defeats the purpose of recovery entirely.

4. Can You Run Your EHR and Clinical Systems Inside the IRE?

• • Can critical applications (EHR, imaging, etc.) function within the environment?
  • Have you tested real-world workflows—not just theoretical recovery?
  • Can clinicians access patient data during an outage?

Why it matters:
A Secure Isolated Recovery Environment (SIRE) isn’t just storage—it’s an operational environment that must support patient care under pressure.

5. Do You Test Recovery Against Real Ransomware Scenarios and RTOs?

• • Do you conduct routine failover and recovery testing?
  • Are tests aligned to real ransomware scenarios?
  • Do you measure recovery time objectives (RTOs) and outcomes?

Why it matters:
A plan that isn’t tested is just a document. In healthcare, that’s a risk you can’t afford.

The Reality Check: Is Your Cyber Attack Recovery Plan Ready?

If you answered “no” or “not sure” to some of these questions, your organization may not be ready for a cyber attack. A partial recovery plan is not enough; with healthcare statistics favoring attackers, a comprehensive and robust plan is essential.

How Comport Helps Hospitals Build and Test an IRE

Building an effective SIRE requires more than technology—it requires deep healthcare expertise and real-world experience.

Comport works alongside healthcare organizations to:

• Assess current recovery gaps and risks
• Design fully isolated, secure recovery environments
• Integrate identity, security, and infrastructure into a cohesive strategy
• Test and validate recovery to ensure clinical continuity

What sets Comport apart is practical experience. Our leadership team understands healthcare from the inside—including hands-on hospital IT experience—and we’ve brought in industry experts like Michael Volpi, former VP of IT for a major health system, to help guide strategy and execution.

The result is an IRE designed not just for recovery—but for maintaining patient care when it matters most.

Not sure how your answers stack up? Get an IRE readiness assessment or talk to our healthcare IT team.

Related reading: How to build an isolated recovery environment in healthcare · Why hospitals are considering an isolated recovery environment

Frequently Asked Questions

What is an isolated recovery environment (IRE)?

An IRE is a separate, protected environment where an organization can restore clean data and run critical systems after a ransomware attack. It is isolated from the production network, uses its own identity controls and stores immutable backups that attackers can’t alter.

What is the difference between an IRE and a SIRE?

They describe the same thing. “Secure isolated recovery environment” (SIRE) simply emphasizes that the environment has its own security and access controls, not just network separation. You may also see the terms cyber recovery vault or clean room recovery.

How is cyber recovery different from disaster recovery?

Disaster recovery restores systems after outages or natural disasters and assumes your data is trustworthy. Cyber recovery assumes attackers may have compromised your data and identity systems, so it restores from isolated, immutable, validated copies into a clean environment.

Are immutable backups enough to recover from ransomware?

No. Immutable backups stop attackers from deleting or encrypting your copies, but you still need a clean, isolated place to restore them, separate identity controls and tested processes to bring clinical systems back online.

What is a good recovery time objective (RTO) for hospital systems?

It depends on the system. Life-critical clinical systems usually need the shortest RTOs, often hours, while back-office systems can wait longer. Set RTOs with clinical leadership and validate them through testing.