Appendix G: Summary of Health Care Implementation Activities

Health Care and Public Health Sector Cybersecurity Framework Implementation Guide

Table 10 consolidates health care implementation activities for all steps in the NIST Cybersecurity Framework implementation process.

Table 10. Health Care Implementation Activities by Step

Implementation Process Steps	Inputs	Activities	Outputs
Step 1: Prioritize and Scope	Risk management strategy Organizational objectives and priorities Asset inventory Informative Reference(s)	Organization determines where it wants to apply the Informative Reference(s) to evaluate and potentially guide the improvement of the organization’s capabilities Threat analysis Business impact analysis System categorization (based on sensitivity & criticality)	Usage scope Unique threats
Step 2: Orient	Usage scope Risk management strategy Informative Reference(s)	Organization identifies in-scope systems and assets (e.g., people, information, technology, and facilities) and the appropriate regulatory and other authoritative sources (e.g., cybersecurity and risk management standards, tools, methods, and guidelines)	In-scope systems and assets In-scope requirements (e.g., organizational, system, regulatory)
Step 3: Create a Target Profile	Organizational objectives Risk management strategy Detailed usage scope Unique threats Informative Reference(s)	Organization selects one or more Informative References and creates a tailored overlay based on a risk analysis that considers the unique threats identified in the prioritization and scoping phase Organization determines level of effectiveness or maturity desired in the selected controls	Target Profile (Tailored overlay of one or more Informative References) Target Tier
Step 4: Conduct a Risk Assessment	Detailed usage scope Risk management strategy Target Profile Informative Reference(s)	Perform a risk assessment for in-scope systems and organizational elements	Risk assessment reports
Step 5: Create a Current Profile	Risk assessment reports Informative Reference(s)	Organization identifies its current cybersecurity and risk management state	Current Profile (Implementation status of selected controls) Current Tier (Implementation maturity of selected controls, mapped to NIST Cybersecurity Framework Implementation Tier model)
Step 6: Perform Gap Analysis	Current Profile Target Profile Organizational objectives Impact to critical infrastructure Gaps and potential consequences Organizational constraints Risk management strategy Risk assessment/analysis reports Informative Reference(s)	Analyze gaps between Current and Target Profiles in organization’s context Evaluate potential consequences from gaps Determine which gaps need attention Identify actions to address gaps Perform cost-benefit analysis (CBA) or similar analysis on actions Prioritize actions (CBA or similar analysis and consequences Plan to implement prioritized actions	Prioritized gaps and potential consequences Prioritized implementation plan
Step 7: Implement Action Plan	Prioritized implementation plan Informative Reference(s)	Implement actions by priority Track progress against plan Monitor and evaluate progress against key risks using metrics or other suitable performance indicators	Project tracking data New security measures implemented

Table 11 correlates the NIST Cybersecurity Framework implementation process with the elements of a risk analysis that accommodate the use of NIST Cybersecurity Framework Core Informative References.

Table 11. Relationship of Cyber Implementation and HHS Risk Analysis Elements

Cyber Implementation Process	Risk Analysis Elements
Prioritize & Scope	Conduct a complete inventory of where ePHI is processed Perform a BIA on all systems with ePHI (criticality) Categorize & evaluate these systems based on sensitivity & criticality
Orient	Conduct a complete inventory of where ePHI is processed
Create a Target Profile	Select an appropriate framework baseline set of controls Apply an overlay based on a targeted assessment of threats unique to the organization
Conduct a Risk Assessment	Evaluate residual risk
Create a Current Profile
Perform Gap Analysis	Rank risks and determine risk treatments Make contextual adjustments to likelihood & impact, if needed, as part of the corrective action planning process
Implement Action Plan	Implement corrective actions and monitor the threat environment

<< Back                                                                                                                                                                              Next >>