The Acquired Subsidiary and the 90-Day Attestation
Northbridge Health System completed its acquisition of a 40-clinician telehealth subsidiary nine months ago. The subsidiary runs its own SaaS EHR on a vendor-hosted platform, holds a SOC 2 Type II report with a nine-month evidence gap, and self-certifies against HIPAA. Northbridge's board has promised the state attorney general a consolidated security attestation within 90 days. The subsidiary's CISO reports to its former CEO, who now reports to Northbridge's COO rather than the enterprise CISO. The enterprise risk register lists the subsidiary as low risk because no breach has occurred, while the subsidiary's register lists three high risks, including unpatched internet-facing imaging servers. Northbridge's risk appetite statement says patient-safety systems may not carry unmitigated high risk. The enterprise CISO must decide how to bring the subsidiary into the governance program without halting clinical operations and what to tell the board.
1. Identify the governance failures in this situation and explain how you would assign accountability and risk ownership before any technical assessment begins.
Read the worked answer
The core failures are structural, not technical.
- Reporting line: The subsidiary CISO reaches the enterprise only through the COO, so a business unit that benefits from accepting risk can override enterprisewide risk decisions. The enterprise CISO lacks an independent reporting path.
- Risk taxonomy: Two registers use different criteria, so “low risk” at enterprise level and three high risks at subsidiary level cannot both be true. This is an aggregation failure, not a factual disagreement.
- Unfunded promise: The board committed to a 90-day attestation before an accountable system owner or authorizing official agreed to its scope.
I would assign accountability first. The subsidiary's clinical or business executive becomes system owner and accepts residual risk in writing. The subsidiary CISO becomes ISSO with a dotted line to the enterprise CISO. The enterprise CISO owns the framework, risk taxonomy, and independent reporting. The COO should not be the risk acceptor for a system in the COO's own chain; that is a conflict of interest. I would convene the risk executive function to rescore the three high risks on enterprise likelihood and impact scales, then translate the risk appetite statement into explicit thresholds: any unmitigated high risk to patient safety requires a time-bound remediation plan and written acceptance by the authorizing official. Only then would I commission an assessment. Scanning first would generate data with no owner and no decision rule.
2. The board wants a 90-day consolidated attestation. Assess whether that is achievable and state what you would include, exclude, or qualify, and what you would tell the board.
Read the worked answer
Ninety days is achievable only as a qualified management assertion, not as an unqualified compliance statement. Three months is enough to inventory the subsidiary's system, update the SSP, obtain the SOC 2 bridge letter, analyze the nine-month evidence gap, and perform targeted testing of the highest-risk controls. It is not enough to close three high risks, cure the evidence gap, or complete a full independent assessment.
I would include the SaaS EHR in scope, with the vendor's SOC 2, a gap analysis, and a customer responsibility matrix. I would exclude nothing silently. Shared IAM, logging, and the imaging servers would be listed as dependencies or in-scope components. The attestation should be qualified to state that three high risks remain open with POA&M dates, that the SOC 2 gap limits assurance for that period, and that testing covered a defined subset of controls. I would not allow the board to tell the attorney general the subsidiary is “HIPAA compliant” or “fully assessed”; that would misrepresent the evidence. If the attorney general requires a broader statement, the board must choose a longer timeline or an explicit scope limitation. The enterprise CISO should draft the wording and refuse to sign anything the evidence does not support. An honest qualified statement protects the organization; an unsupported clean statement creates a misrepresentation risk.