Cybersecurity Practices for Health Care Organizations~ RJ BLANCHARD BENEFIT SERVICES

Threats Mitigated 1. E-mail phishing attacks 2. Ransomware attacks 3. Loss or theft of equipment or data 4. Insider, accidental or intentional data loss 5. Attacks against connected medical devices that may affect patient safety

Suggested Metrics 

Number of policies reviewed over a specified timeframe. The goal is to establish a standard practice to review policies and to monitor compliance with this standard.



Number of workforce members who review and sign off after reading policies over a specified timeframe. The goal is to establish a standard practice for workforce members to review applicable policies and attest to the review, and for the organization to monitor compliance with this standard.

Cybersecurity Practices for Health Care Organizations~ RJ BLANCHARD BENEFIT SERVICES

Articles inside

Appendix B: References

Table 13. Incident Response Plays for Attacks Against Medical Devices

Table 15. Acronyms and Abbreviations

Table 14. Example Cybersecurity Policies for Consideration

Cybersecurity Practice #9: Medical Device Security

Table 12. Timeframes for Resolving Medical Device Vulnerabilities

Table 11. Roles and Responsibilities for an Organizational CIRT

Table 9. Factors for Consideration in Penetration Test Planning

Cybersecurity Practice #6: Network Management

Cybersecurity Practice #8: Security Operations Center and Incident Response

Table 10. Example Incident Response Plays for IR Playbooks

Cybersecurity Practice #7: Vulnerability Management

Cybersecurity Practice #5: IT Asset Management

Table 7. Expanding DLP to Other Data Channels

Table 6. Data Channels for Enforcing Data Policies

Table 3. Example of a Data Classification Schema

Table 5. Security Methods to Protect Data

Table 4. Suggested Procedures for Data Disclosure

Cybersecurity Practice #4: Data Protection and Loss Prevention

Cybersecurity Practices at Medium-Sized Health Care Organizations

Table 1. E-mail Protection Controls

Cybersecurity Practice #3: Identity and Access Management

Cybersecurity Practice #2: Endpoint Protection Systems

Table 2. Basic Endpoint Controls to Mitigate Risk at Endpoints

Cybersecurity Practices at Large Health Care Organizations

Cybersecurity Practice #1: E-mail Protection Systems

Introduction