Scoping a Hospital Chain's First Intelligence Requirement
Northgate Health is a 12-hospital nonprofit with 9,400 staff, 1,600 endpoints, and 22,000 mailboxes. Last year a ransomware incident encrypted three file servers and caused 11 days of partial EHR downtime; the ransom was not paid. The new CISO has $250,000 per year for threat intelligence and one analyst at 60% FTE. The board wants a single 'threat level' score on its dashboard by next quarter. The MSSP offers 1.2 million indicators per day plus a weekly PDF, the sector ISAC provides ransomware bulletins, and the regional FBI field office offers quarterly briefings. Clinical leaders care about uptime and patient safety; IT operations wants blocklists; legal is concerned about HIPAA exposure. The CISO asks you to define the program's first intelligence requirements and recommend what to consume.
1. Draft three priority intelligence requirements for Northgate Health and explain why each outranks the board's request for a single threat-level score.
Read the worked answer
Three PIRs I would propose:
- Which initial-access vectors are currently used against hospital ransomware victims of similar size, and how do they map to our VPN, remote-management, and email exposure?
- Which affiliates or actors are targeting our region and sector, and what patient-safety or EHR-availability thresholds have they crossed in past incidents?
- Which identity providers, managed service providers, and clinical vendors in our estate appear in pre-attack reconnaissance or credential markets?
Reasoning: a PIR must change a decision. The first drives VPN patching, RMM restrictions, and phishing controls; the second drives downtime playbooks and executive risk acceptance; the third drives vendor-risk reviews. The board score is a derived output, not a requirement. If the score rises, no one knows what to do differently. Requirements should name the decision owner, source, cadence, and confidence needed. I would map stakeholders explicitly: clinical operations for patient-safety impact, IT operations for blocklist feasibility, legal for HIPAA and breach thresholds. The board can still receive a score later, but only after we define inputs and decision triggers.
2. Recommend the initial mix of sources and processing capacity for the $250,000 and 0.6 FTE, including what to decline.
Read the worked answer
With 0.6 FTE, 1.2 million indicators per day is not consumable. That is 50,000 per hour; human review is impossible and raw blocking would harm clinical availability. I would keep the ISAC and FBI briefings because they are low-cost, sector-specific, and provide context. I would use the MSSP feed only through curated, high-confidence alerts or a TIP with allowlists and expiration, not as an unfiltered blocklist. I would fund one operational feed that includes actor and TTP context, subject to a 30-day trial, plus enrichment services and a small reserve for incident surge. Indicative split: $90,000 to $120,000 for curated intelligence and platform, $30,000 for enrichment, and $50,000 held for surge or specialized reporting. I would decline the weekly PDF as the primary product and any vendor selling a single score. The analyst should own PIRs, source evaluation, and high-severity review; the SOC should consume machine-readable indicators with confidence and expiry. This is a capacity-matched design, not a feed shopping list.
3. How would you respond to the board's dashboard request without misleading them?
Read the worked answer
I would explain that a single threat-level score compresses dissimilar risks and hides the drivers that executives need to act on. It also creates false precision and invites comparison across organizations with different exposure. Instead, I would offer two layers. First, a small set of decision-linked indicators: ransomware initial-access attempts blocked, MFA coverage for remote access, VPN patch latency, third-party alerts affecting clinical vendors, and time to contain simulated ransomware. Second, a short narrative of what changed this week, with confidence and source quality stated. If the board insists on a score, I would define its inputs, weights, scale, uncertainty, and the specific decisions it triggers. I would avoid green/amber/red without an explanation of what would move the rating. I would rehearse the dashboard in a tabletop so directors see how it supports downtime decisions rather than replacing judgment. The goal is decision support, not a comforting number.