Call us now:
The pace of change across digital is frightening. In the case of cyber and AI 2 years is several life times, as has been clearly demonstrated by the introduction by Open Ai of Chat GPT. It is what makes the enclosed report of interest.The enclosed Ministerial report published this week can only be described as a distressing indicator of the state of UK healthcare cybersecurity. It is based upon a 2023 document ‘A cyber resilient health and adult social care system in England: cyber security strategy to 2030’. That references the use of Network and Information System regulations of 2018. It surveyed the cybersecurity of 575 regulated care providers, and in-depth interviews with 15 care providers, 10 technology suppliers and 16 adult social care representatives.It found that 79% had used some well-established approaches to identify cyber threats within the last 12 months, 17% did not use any measures and 4% did not know if they had. The most common approaches were risk assessments 62% reported carrying this out, testing staff awareness and response (41%) and/or carrying out cyber security vulnerability audits (38%).On average care providers spent £2,575 dealing with cybersecurity incidents over the last three years. The average cost incurred from a cyber incident was £24,064 over the past three years.Self reported awareness of cybersecurity practices ranked at 90% (they taught themselves). Only 27% of care providers went to an internal experts on cybersecurity for help. Some care providers relied heavily on policies and procedures without a full grasp of cyber security risks.Care providers showed a high level of confidence in their organisation’s ability to deal with a future cyber incident. 75% had policies for who to notify incidents to and have incident response and continuity plans in place. 81% backed up data and 96% said backup data was useable.Technology suppliers – you just have to read this for yourselfRelationship between care providers and technology supplier – I just don’t know what to say about this section other than from the end client perspective cyber risk management resides the accountability of the care provider. Cyber risk is not owned by technology providers. You cannot transfer ownership of risk, you can transfer the responsibility for managing risk.I liked the statement – ‘Some care providers demonstrated a high level of engagement with cyber security’.If this report is indicative of cybersecurity across the health system then what does it say? What has the UK government been doing over the past 20 years to enforce cybersecurity risk management. At a time when the EU has driven ahead to regulate cybersecurity of health providers and the US has driven HIPAA across the health sector.@Thaddeus Dziekanowski Brian D. McCarthy Faisal KhanVeritas GRC#cybersecurity #cyberriskmanagement #cyberregulation
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7310270555658637312