One Risk Register, Four Competing Proposals
A three-hospital health system with 14 outpatient clinics has asked you, its security director, to produce one enterprise risk register for the board. Your staff is two FTEs and a $1.4M annual budget. In the last 12 months: a clinic ransomware event caused 31 hours of downtime, one unencrypted laptop with 4,000 patient records was stolen from a nurse's car, nine tailgating incidents were logged at the main hospital, and after-hours intrusion alarms at a warehouse produced 60 false dispatches. The CISO wants $380K a year for a managed detection service; the facilities VP wants $620K for badge-reader replacements at all 17 sites; you hold quotes for $210K in camera analytics and $40K for tabletop exercises. The board chair has asked for one risk score per site on a 1-10 scale.
1. How would you structure the risk assessment and the register so the board can compare a ransomware outage, a stolen laptop, and a tailgating incident on the same page?
Read the worked answer
Work asset-based, not incident-based. Enumerate the assets that matter (patient records, clinical operations, people, buildings, reputation, regulatory standing), then for each credible scenario rate threat likelihood, vulnerability and consequence on defined 1-5 anchors so a clinician and a finance analyst score the same way. Consequence should carry separate sub-ratings for life safety, regulatory exposure (HIPAA here), financial loss, and mission interruption - a 31-hour outage and 4,000 exposed records are not the same kind of harm and should not collapse into one number yet.
Convert what you can to money: annualized loss expectancy for the laptop scenario (records × notification cost + fine exposure × probability) puts a $40K tabletop and a $380K detection contract on the same axis. Record inherent and residual risk side by side so the board sees what each proposal actually buys.
Every register line gets a named owner outside security, a review date, and an explicit statement of the risk appetite it is being measured against. Without an owner and a review cycle the register becomes a snapshot that is stale in 90 days.
2. The board chair insists on a single 1-10 risk score per site. How do you respond?
Read the worked answer
Push back once, with a workable alternative, then comply in a way that preserves the information.
The objection: a single score hides its drivers, creates false precision (is 6.2 really worse than 5.9?), and lets a site with excellent life-safety performance but poor cyber hygiene rank alongside a site with the opposite profile. Boards then make capital decisions on arithmetic noise.
The compromise: produce the composite score, but publish the weighting and supply a one-page risk card per site - top three risks, the driver for each, the trend arrow, and the single control that would move it. Run a sensitivity check: if shifting the weights by 20% changes the ranking, say so on the page. That gives the chair the ranked list she asked for and gives the audit committee something defensible.
Also establish the rule that the composite cannot override a floor condition. A site with an unresolved life-safety finding is escalated regardless of its average.
3. The CISO and the facilities VP are each lobbying the CFO separately. What governance mechanism do you propose, and why does it matter here?
Read the worked answer
Stand up a security risk council chaired by the CFO or COO - not by you - with the CISO, facilities, clinical operations, legal, HR and the site administrators as members. One intake form for proposals, one scoring rubric drawn from the register, quarterly meetings, minutes published.
The reason is structural, not political. Two advocates calling on the CFO in private competition produce decisions based on who is more persuasive in a hallway, and the losing function disengages from the program. A common rubric forces both proposals to state which register line they reduce and by how much, which is exactly the argument the CFO wants to hear.
It also captures convergence: badge data and network authentication data describe the same people. If facilities replaces readers and the CISO buys detection separately, you pay twice for identity infrastructure and still cannot correlate a terminated contractor's badge swipe with a VPN login. Put both under one governance roof before either project is scoped.