A document that is well worth reading for any company making a written response to a U.S Senate Committee, as United Health (UH) responds to…

← Back to Blog

A document that is well worth reading for any company making a written response to a U.S Senate Committee, as United Health (UH) responds to questions raised by U.S Senate Committee on Finance. The response raises many more questions than can be answered, least of all the companies responses don’t always answer the questions posed in part, fully or at all, in some cases repeating responses.

One wonders if the response was written with a view to future legal action?
1. We now know the company spends $300 million a year on cyber and employees 1,300 cyber professionals. (Thats equivalent to systemically important banks).
2. The companies board doesn’t appear to have a handle on cybersecurity risk management.
3. Corporate governance is lacking. The Audit and Finance Committee overseas cybersecurity risk. Board cyber advisors were employed after the attack.
4. The hackers got access to Active Directory (one wonders the privileges).
5. No response to who has been affected by the attack or how much data was taken (including U.S Military). Data from the hack was made available to UH by the FBI. UH follows gold standard for making notifications.
6. UH is Audited to HITURST for HIPAA, (no idea by who).
7. Cyberattacks are well documented across healthcare, UH should have been well aware of the threat and taken appropriate action.
8. No clarity of the plans in place to protect data following the attack.
9. UH applies its cybersecurity standards to Change Healthcare when it acquired the company.
10. UH rebuilt its infrastructure and re-issued 11,000 devices.

One feels the responses given by UH are strategic in light of possible litigation by Federal Agencies and legal actions (you’d expect it). There is no clarity over the companies cybersecurity risk management outside of HIPAA and HITRUST. Or response that could be used to challenge UH compliance with the SEC Final Cyber rule over cybersecurity risk management governance, oversight and assurance by the board. Or responses that could in ones opinion be used as evidence during a future investigation.

One would love to see a copy of the cybersecurity risk register presented to the last 4 Audit and Finance committee meetings.

Note the absence of the words CISO, Risk Assessment, Security Standards.

@Thaddeus Dziekanowski Brian D. McCarthy Rachel V. Rose, JD, MBA Faisal Khan

Veritas GRC

#cybersecurity #cyberriskmanagement #cyberregulation

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3AugcPost%3A7206190347620601856