Utilities operate a SCADA gateway stack in AWS with written AZ-loss runbooks that have not been exercised recently. What should architects schedule?

Utilities SCADA gateway stacks with written AZ-loss runbooks that have not been exercised recently carry false confidence. Scheduling controlled game-day failure-injection exercises that simulate AZ loss validates that recovery runbooks, monitoring, and automation still work against the live AWS design. That practice works because operational excellence for critical utilities connectivity depends on rehearsed recovery, not shelf-ware documentation. Assuming runbooks remain correct forever without testing fails because architectures and IAM change while documents go stale. Deleting the runbooks to reduce clutter before an audit fails conceptually—removing guidance does not remove the need to recover. Only testing failover during a real regional emergency with citizens already impacted fails as an unethical and unmanaged validation strategy. Exam caveat: game days need blast-radius controls, abort criteria, and stakeholder notice—especially near SCADA—so drills improve readiness without creating a real outage. Operational check: pick a maintenance window, inject a controlled AZ impairment in nonprod or a carefully scoped prod dependency, execute the runbook timer in hand, record gaps, and update automation within a fixed remediation SLA.