My View - cyber maturity in healthcare - why technology alone is not enough

MY VIEW - Mathew Jose, chief information security officer, FUJIFILM CodeBlue 

Healthcare organisations depend on digital systems to deliver care, protect sensitive information and keep essential services running.

As expectations around cyber security increase, organisations must be able to do more than show that security tools are in place. They need to demonstrate that cyber risks are governed, controls are operating consistently and the organisation is prepared to respond when something goes wrong. 

What the Health NZ checklist means in practice  
The Health NZ cyber security checklist provides a way for healthcare organisations to assess whether they have reached an appropriate baseline level of cyber maturity. 

It draws on the National Cyber Security Centre’s Cyber Security Capability Maturity Model, or CS CMM. For organisations expected to demonstrate Level 2 maturity, also known as “Planned and Tracked”, simply having cyber security controls in place is not enough. 

Organisations need to show that their policies, capabilities and controls are established, repeatable, managed and supported by evidence. 

In my view, the checklist is less about compliance and more about confidence. Can an organisation demonstrate that it is protecting the health information entrusted to it? Can it show that its services can continue operating during and after a cyber incident? 

These are not purely technical questions. They are questions about organisational resilience, accountability and trust. 

Why technical reporting alone may not provide sufficient evidence 
A common misconception is that having security tools automatically demonstrates cyber maturity. 
Technical reports may show that multi factor authentication is enabled, vulnerabilities are being scanned or backups are running. These reports are useful, but they do not provide the complete picture. 

They do not necessarily show whether: 

• The controls have clear ownership
• Exceptions are identified and managed 
  
• Risks are understood and accepted appropriately 
  
• Policies and processes are regularly reviewed 
  
• Leadership has appropriate oversight of cyber risk 
  
• Controls are working consistently across the organisation 
  

As the name “Planned and Tracked” suggests, Level 2 is not simply about producing dashboards and technical reports, it requires ownership, policies, reviews, informed decision making and accountability. 

The organisation must be able to show not only that a control exists, but also that it is governed, maintained and operating as intended. 

The role of governance, supplier oversight and incident preparedness 
Governance, supplier oversight and incident preparedness are particularly important because they are recognised within both the Health Information Security Framework and broader cyber maturity expectations. 

Healthcare organisations increasingly depend on cloud providers, software vendors and managed service providers. As a result, some of their most significant cyber risks may sit outside their direct control. 
Strong governance ensures cyber risk is understood and managed at leadership level. It provides clarity about who owns each risk, how decisions are made and when an issue should be escalated. 

Supplier oversight helps organisations understand the risks introduced by third parties. This includes knowing what information suppliers can access, what security controls they have in place and how they would respond if an incident affected their service. 

Incident preparedness ensures there is a clear and structured response when something goes wrong. Leadership teams should understand who has decision making authority, how the organisation will communicate, which services must be restored first and how patients, staff, suppliers and other stakeholders will be supported. 

In many cyber maturity assessments, these areas reveal the difference between an organisation that owns security tools and one that has established genuine cyber maturity. 

Practical steps healthcare leaders can take to strengthen cyber maturity 
Healthcare organisations should start with the fundamentals, as these provide the foundation for meeting baseline maturity expectations. This includes being able to demonstrate appropriate controls across areas such as: 

• Multi-factor authentication  
  
• Patch and vulnerability management  
  
• Access management  
  
• Security monitoring  
  
• Staff awareness and training  
  
• Backup and recovery  
  
• Incident response planning 
  

However, healthcare leaders should recognise that this is not solely a technology exercise. 

The next step is to focus on governance and evidence. Organisations should: 

• Assign clear ownership of cyber risks and controls  
  
• Document critical policies and processes  
  
• Identify and assess important assets  
  
• Review third party providers regularly  
  
• Test incident response plans  
  
• Record and manage exceptions  
  
• Report cyber risk to leadership and the Board  
  
• Maintain evidence that controls are reviewed and operating consistently 
  

For many organisations, moving from Level 1 to Level 2 maturity may require less investment in new technology than expected. The greater challenge is often establishing consistency, accountability and evidence around the controls already in place. 

Treat the checklist as a maturity assessment, not a technical assessment 
One of the biggest mistakes organisations can make is treating the Health NZ checklist as a purely technical assessment as the checklist should be treated as a maturity assessment, not simply a review of technical controls.  

The question is not simply: “Do we have multi-factor authentication?” 

The more meaningful question is: “Can we demonstrate that cyber security risk is being managed in a repeatable and accountable way?” 

Cyber risk needs to be managed with the same discipline that organisations apply to health and safety. Having procedures written down is not enough. Responsibilities must be clear, practices must be embedded and leadership must have confidence that the organisation is prepared. 

That is ultimately what Level 2 maturity is intended to achieve. It is also why governance, supplier oversight and incident preparedness matter just as much as technical controls. 

Read more VIEWS

Return to eHealthNews.nz home page