Audit Casefile INCIDENT #404-B
ROOT ACCESS · S1: CASE 001

001. The Med Room Override 🔍

Township General Hospital • Floor 3 Med Room • Oct 13, 2026 — 02:05 AM
Lead Auditor Case Log

During the nightly 02:00 AM cloud server sync, the Floor 3 Med Room keycard reader dropped offline for 6 minutes. Emergency access was logged using default bypass PIN 8842#, dispensing a scheduled narcotic dose without a badged user ID.

STAFF // WHO

PERSONNEL LOGS
🩺 NURSE NORA
Nurse Nora (Charge Nurse) FL 3 WEST

Wears thick lavender compression socks; fiercely protective of floor staff.

5'6" • RIGHT-HANDED • BROWN EYES
"I was bedside on Fl 3 West from 01:50 to 02:15 AM administering IV fluids."
🐊 DR. DAVE
Dr. Dave (Anesthesiologist) ANESTHESIA

Insists on bright yellow Rubber Crocs; carries an empty thermal tumbler.

6'1" • LEFT-HANDED • BLUE EYES
"I was in the Anesthesia Workroom charting until 02:10 AM."
🍵 PT PAIGE
PT Paige (Physical Therapist) REHAB DEP

Wears navy windbreaker, sips iced matcha lattes at 2:00 AM.

5'7" • RIGHT-HANDED • GREEN EYES
"I was retrieving a gait belt from Rehab Storage Fl 2 until 02:15 AM."

EVIDENCE // WHAT

RECOVERED ITEMS
🔑

PIN 8842#

Default bypass code used on vault.

🐊

YELLOW JIBBITZ

Broken shoe charm jammed in keypad.

🍵

MATCHA LATTE

Spilled beverage left on console.

LOCATIONS // WHERE SECTOR CODES

🚪

FLOOR 3 MED ROOM

[FL3]

Failover door override site at 02:05 AM.

🖥️

ANESTHESIA ROOM

[FL3]

Floor 3 East charting station.

📦

REHAB STORAGE

[FL2]

Physical therapy depot on floor below.

CLUES & DISCOVERY EVIDENCE CONFIDENTIAL AUDIT

  • ▸01:50 – 02:15 AM: Floor 3 West telemetry confirms Nurse Nora was continuously bedside at Bed 312.
  • ▸02:00 – 02:06 AM: Cloud sync active; lock reader dropped into offline failover mode.
  • ▸02:05 AM: Keypad bypass PIN 8842# entered on Floor 3 Med Room door; vault unlatched.
  • ▸02:14 AM: PT Paige used badge scanner to enter Rehab Storage on Floor 2.
  • ⚠️ CRITICAL FINDING: Broken crocodile charm was found jammed inside the Med Room keypad strike-plate!
AUDIT LOGIC MATRIX STATUS: INTERACTIVE
STAFF LOCATIONS
🩺 🐊 🍵 🚪 🖥️ 📦
EVIDENCE
 🔑
🐊
🍵
LOCATIONS
 🚪
🖥️
📦
Bonus: What are the Failed NIST Controls?PUZZLE
  • • IA-5(1): [REDACTED FOR AUDIT PUZZLE]
  • • PE-3 / SC-28: [REDACTED FOR AUDIT PUZZLE]
  • • AU-8: [REDACTED FOR AUDIT PUZZLE]
  • • AC-6(1): [REDACTED FOR AUDIT PUZZLE]
REF: LOG-SYS#001
PART I

The Investigation Reveal

CASE SOLVED
Official Suspect Identification
CONFIDENCE: 100%
DR. DAVE
🐊
YELLOW JIBBITZ
🐊
FL 3 MED ROOM
🚪
🕵️ Operational Reconstruction Narrative

"At 02:03 AM, capitalizing on the recurring cloud server sync blackout, Dr. Dave slipped out of the East charting corridor into the unmonitored Floor 3 Med Room vestibule. Anticipating that offline badge authentication would fail, he entered the unpatched factory bypass code (8842#). In his rush to exit before the cloud reconnection at 02:06 AM, his yellow Croc struck the heavy fire-door frame, severing his rubber crocodile Jibbitz directly into the deadbolt receiver strike-plate. Telemetry proof eliminates Nurse Nora, while access logs place Paige on the floor below."

PART II

IT Audit Workpaper & Formal Report

WP-2026-S1-001
AUDIT CASE ID WP-2026-S1-001
LEAD AUDITOR Ben Vance, CISA
ENGAGEMENT DATE Oct 13, 2026
FACILITY / SITE Township General Hospital
SYSTEM ASSESSED AccuLock MedSafe v2.1.0
CLASSIFICATION RESTRICTED // FORMAL

NIST SP 800-53 Rev. 5 Control Gap Analysis [ACCESS & TELEMETRY CONTROLS]

4 DEFICIENCIES IDENTIFIED
CONTROL ID CONTROL NAME STATUS ROOT CAUSE & FAILURE ANALYSIS RISK LEVEL
IA-5(1) Default Authenticator Bypass NON-COMPLIANT / DEFICIENCY Default factory PIN 8842# enabled in local flash memory without expiration or initial forced change upon hospital deployment. CRITICAL
PE-3 / SC-28 Offline Failover Cache Protection NON-COMPLIANT / DEFICIENCY Keypad firmware maintains unpurged local failover access mode during cloud network disconnections; cache unrefreshed since firmware flash in 2022. HIGH
AU-8 Audit Record Timestamp & Telemetry Sync DEFICIENCY Standalone keypad door logs not synchronized with central hospital SIEM during offline network drop, allowing untracked manual entries without central alerting. HIGH
AC-6(1) Least Privilege / Emergency Access Logs DEFICIENCY Emergency override does not associate credential with individual badge ID; directly bypasses dual-custody scheduled narcotic dispense controls. CRITICAL

Corrective Action Plan (CAP) Matrix [REMEDIATION MILESTONES]

MANDATORY EXECUTION
CAP ITEM # REMEDIATION ACTION OWNER TARGET SLA VERIFICATION METHOD
CAP-01 Forced immediate firmware rotation disabling all default factory PINs across all hospital medical wards. Hospital IT SecOps Immediate / 24h Automated pen-test of all ward doors verifying default PIN rejection.
CAP-02 Firmware patch to isolate failover mode with local encrypted credential cache requiring localized challenge-token. MedSec Engineering 14 Days Offline disconnect simulation test and non-volatile cache audit.
CAP-03 Implement dual-factor biometric or physical keyed bypass requiring dual custody for narcotics vaults. Pharmacy Operations & Compliance 30 Days Physical security audit and dual-witness badge swipe verification.
ROOT ACCESS AUDIT ARCHIVE // REF: FORM-NIST-800-53-WP01 PAGE 1 OF 1 • CLASSIFIED CONFIDENTIAL
FACILITY DOSSIER EXTERIOR CAM
GRID REF // NW-01
▣ SIGNAL LOST // EXTERIOR CAM NW-01 Maintenance ticket #4821 — facilities notified