The healthcare sector sustains more ransomware attacks than any other industry, with this kind of cybercrime rising 49% in 2025 compared to the previous year. That fact alone highlights cybersecurity as a major challenge that your board of directors needs to address head-on.
Boards think of cybersecurity as a technical matter best left to IT professionals, but cybersecurity is primarily about robust policies rather than technical IT knowledge. Viewing the issue through a policy lens lets leaders take actionable steps to manage this crucial challenge. Adopting a policy-forward perspective will help the board reclaim its agency and empower your stewardship role as you work to protect your organization.
Where to Start
Cybersecurity starts with awareness. It includes protecting sensitive data, yes, but also encompasses the organization’s internal processes, regulatory compliance and more. With so many strategic and operational elements in play, it’s essential for the board to provide knowledgeable cybersecurity oversight.
Instead of taking a deep dive into technical details, boards should focus on managing risk, protecting the organization’s reputation, and using key metrics to gauge how well a comprehensive cybersecurity plan is performing under real-world conditions.
Establishing and enforcing robust policies is imperative, but top-down cybersecurity initiatives can only go so far. Leaders must also nurture a culture where every member of the organization understands the importance of cybersecurity and knows how to advance the broader goal through specific actions in their daily work.
Each organization adopts a unique combination of tactics and technology, codified in a comprehensive plan, to create a secure digital environment. Your plan should reflect current risks and strategies to mitigate them, but also allow for resilience in the face of a constantly evolving threat environment. That kind of plan begins with questions.
Questions to Ask
It’s natural to jump straight to technology when the topic of cybersecurity arises, but this is where productive conversation at the board level can often stop. Avoid this pattern by asking higher-level questions, the ones that drive decisions about tech tools and all the other strategies at your disposal to manage risk. Consider:
- What are our most important assets?
- How are we protecting them?
- How would we detect a breach of systems or data?
- How would we respond to a breach or another type of cybersecurity incident?
- What responsibilities does the board have before, during and after an incident?
- What plans are in place to guide business recovery following an incident?
- Does our current investment in cybersecurity align with the level of risk present?
Risks to Recognize
Open-ended questions like those above can spur meaningful discussions that help board members gauge risk, then detect and remedy gaps in the umbrella of protection you’re creating. And the fact is, healthcare organizations face a disproportionate number of cyber risks. It’s important for leaders to recognize the scope of the problem.
While not the only considerations, this list illustrates the wide variety of existing and emerging threats that your board of directors should recognize:
- Ransomware becomes more sophisticated with every passing year.
- Securing the cloud is challenging with growing dependency on cloud-based platforms and vendor solutions.
- Unsecured smart medical devices are increasingly common, and these devices can allow bad actors to access sensitive information.
- Remote work establishes multiple environments that the organization doesn’t control.
- Third-party risk rises as organizations integrate more vendors and vendor platforms into the network.
- Meeting rigorous standards associated with security assurances and certifications such as HIPAA, NIST and other security frameworks is an ongoing responsibility.
- Private patient data has become a valuable marketing tool that opens the door to class action lawsuits.
- Regulatory compliance for cybersecurity around critical infrastructure represents an evolving burden as state and federal requirements respond to growing concerns.
- Resuming standard operations following a cyberattack demands accurate risk assessment, including third-party risk management.
- Cyber liability insurance confers valuable support and peace of mind, but it comes at a cost and carries coverage limits that may still allow excessive risk exposure.
Steps to Take
Armed with a realistic awareness of the risks, you’re positioned to begin creating an action plan. In broad strokes, here’s your to-do list:
- Objectively assess the organization’s vulnerabilities and risks. This is a job for tech professionals. Your internal IT staff can handle some aspects, with assistance from third-party professionals who may conduct penetration testing or perform other work to identify security gaps and areas that need reinforcement.
- Adopt a robust approach to prevention. How will the organization guard against the many different cyberthreats that exist? Your comprehensive plan should include a clear description of policies, processes, tools and tactics you’ll use to maintain a secure environment, including individual roles and ownership of specific responsibilities.
- Create a detailed incident response plan. In the event of a cyber incident, responding quickly can mean the difference between an annoying problem and one that carries devastating consequences for the organization. The board should be involved in creating and approving a step-by-step guide that lets everyone know what to do after an event comes along, with contact information for third-party providers, insurers, regulators and other relevant parties.
- Rinse and repeat. Cybersecurity is not a “set it and forget it” business concern; it’s an ongoing responsibility that demands continual monitoring and reassessment. Each step on this list merits repeating at regular intervals to keep up with changes in technology and the threat landscape.
Cyber Control Basics to Minimize Risk
Your internal and external IT professionals can handle many cybersecurity tasks and technical details far removed from the board’s knowledge and skill set. However, board members can also take responsibility for oversight of essential cyber controls. Making these actions policy and monitoring compliance will help your board ensure that the organization has in place key defenses for healthcare providers:
- Identify and prioritize protection of critical assets.
- Enforce multi-factor authentication and other identity access management tactics.
- Segment networks, systems and data to allow only as-needed use.
- Minimize privileged accounts and enforce strong processes for these users.
- Create and adhere to a thoughtful end-of-life process for software.
- Test backups frequently and ensure that backed-up data is segmented.
- Make updating software and applying patches an urgent, day-one priority.
- Encrypt, purge and destroy sensitive data in line with regulatory requirements.
- Structure cloud applications for maximum visibility over what the applications are doing, how they are performing, and where errors occur in real time.
- Require and monitor IT security standards for all vendors and third-party partners.
- Provide regularly recurring, organization-wide cybersecurity training.
- Focus on vendor risk management with clear, written policies and monitoring.
- Test and update your incident response plan on a regular basis.
- Invest in the technology, training and support necessary to protect the organization.
- Establish a cybersecurity culture that includes every team member, every day.
- Review cyber insurance coverage for alignment with real-world risks.
Day One Response Plans
As part of your cybersecurity obligations, the board should oversee the creation, testing and regular updates of a Day One Response Plan. This document will be invaluable guidance in the event of a cyber incident. It will serve as a roadmap that lets each team member know what to do and who to contact to help the organization mount a quick and effective response. Every moment matters following a cyberattack, so designing and testing this plan is a wise investment of the board’s time and attention.
Each organization will have a slightly different plan that reflects your unique assets, risk profile and organizational structure. Your plan should be extremely detailed, but the big-picture timeline typically follows a similar pattern across different healthcare organizations. Generally speaking, your day-by-day response might look something like this:
Day 1: Stop the Carnage
- Contact law authorities and cyber insurance providers
- Mobilize your incident response team
- Disconnect from the network
- Contain the spread of malware
- Confirm network segmentation is active
- Restore the most recent backups
- Assess current data access
- Make a plan to limit impact, repair affected systems and restore data access
- Engage the organization’s PR team (or a third-party provider) to manage communications with internal and external stakeholders
Day 2: Restore a Safe Environment
- Isolate any infected components from data components to be restored
- Quarantine data as you recover it from backups or cloud platforms, while you assess its condition and verify that it is uncontaminated by malware
- Move verified data into a “Clean Zone.”
- Ensure that the Clean Zone is completely separate from systems and network segments with potential contamination
- Work with vendors and manufacturers to safely manage medical equipment, smart devices and appliances
Day 3: Remediate and Recover
- Rebuild data sets using clean or decrypted data.
- Begin business processes and services using the verified clean data
- Focus on clear communications (using channels other than email, if email is or may be affected)
- Plan for extended cleanup actions using internal resources following cessation of formal support from cyber insurance providers, manufacturers and vendors
Day 4: Return to (Semi-)Normal Operations
- Recognize that your teams need rest even if the problem isn’t fully resolved
- Focus on clear communications to avoid misunderstandings in the face of exhaustion and frustration
- Prioritize the most critical operations as you move toward fully operational status
- Begin reviewing the remediation and recovery process, looking for opportunities to improve the response plan for future events
- Encourage and support employees, while avoiding (and discouraging others from) assigning fault or blame
Find Real Protection Against Real and Rising Cyber Risks
Your board of directors has a responsibility to provide effective leadership in today’s intense cyberthreat landscape. Our knowledgeable cybersecurity experts understand what healthcare organizations are going through and offer practical guidance to help you minimize cyber-risk of all kinds. Reach out today to discover smart strategies that protect your board and your organization.
