Budget-Constrained Risk Treatment After a Damning Internal Audit
Meridian Health Network runs six hospitals and 210 outpatient clinics across two EU member states, with 38,000 staff and a legacy EHR that will not be replaced for at least three years. Last month's internal audit found that 41% of 2,900 networked medical devices run end-of-support operating systems, 63% of privileged accounts have no phishing-resistant MFA, and that in a tabletop exercise the incident team took nine hours to decide whether a breach was notifiable against a 72-hour regulatory deadline. The board has approved EUR 3.8 million for the coming year, roughly one-third of what the CISO requested, and wants a plan it can defend to the regulator and to the cyber insurers who underwrite the network. A merger with a 40-clinic chain in a third country is due to close in nine months and due diligence has not begun. The CISO presents the treatment plan in three weeks.
1. How should the CISO sequence and justify risk treatment across the three audit findings with only one-third of the requested budget, and what must be documented?
Read the worked answer
Treat the shortfall as a decision to accept risk explicitly, not a gap to hide. Put all three findings in one register scored against the network's own appetite statement, adding a clinical-safety dimension because device compromise delays care rather than merely exposing data.
Sequence:
- Notifiability gap first. It is the cheapest risk to retire: a decision tree, a named on-call privacy lead, a 60-minute escalation SLA and a pre-drafted assessment form cost little. It is also a multiplier on every other risk, because a missed 72-hour deadline converts a containable incident into a regulatory and insurance problem. The nine-hour tabletop result is therefore the highest value-per-euro fix.
- Privileged MFA second. Stolen credentials are the dominant initial access route into hospital estates, and 63% of privileged accounts without phishing-resistant MFA is precisely the finding an underwriter will price. Fund FIDO2 tokens for the privileged population, perhaps 5% of accounts, rather than a network-wide rollout.
- Device segmentation third, not patching. 41% of 2,900 devices cannot be remediated in twelve months because vendor validation and clinical sign-off gate every change. Contain them in clinical VLANs with allow-listed flows while a device inventory and vendor escalation plan matures.
Document accepted residual risk per finding with a named owner, an expiry date and a re-review trigger, so the board is accepting a quantified position rather than an unfunded wish list.
2. The merger closes in nine months and due diligence has not started. What governance work must happen before and immediately after closing, and what should the CISO refuse to accept?
Read the worked answer
Merger integration is a governance obligation, not an IT project, and the closing date cannot be allowed to set the risk appetite.
Before closing:
- Run security and privacy due diligence to price inherited liabilities: unpatched estate, breach history, unlawful cross-border transfers, processor contracts, device inventories, penetration test results.
- Map data flows and establish the lawful basis for transferring records into the group, since the target sits in a third country.
- Agree a security baseline the acquired entity must meet at day one and a transition services agreement covering the gap period.
- Report findings to the board with a price, because the board is buying the risk as well as the clinics.
At and after closing:
- Federate identities rather than merging directories flat; a bulk directory merge replicates the orphaned-account problem the audit already identified, now across 40 more sites.
- Set day-one controls (EDR coverage, MFA on remote access, backup verification) and a day-100 remediation plan with evidence.
What to refuse: signing off diligence as complete while material findings are open, absorbing the target into Meridian's regulatory perimeter without a re-scoped risk assessment, and accepting a closing timetable that requires controls to be documented after go-live rather than before.
3. Which five metrics should the board see quarterly, and what makes each resistant to gaming?
Read the worked answer
Board metrics should measure residual risk and decision quality, not activity volume. Alerts triaged and phishing simulations clicked are easy to game and say nothing about exposure.
Recommended set:
- Percentage of privileged accounts with phishing-resistant MFA, not any MFA: the definition is binary and verifiable from the identity provider, so it cannot be inflated by enrolling SMS.
- Percentage of networked medical devices either on a supported OS or isolated in an enforced segmented VLAN, measured by network policy compliance rather than by a spreadsheet claim. Both acceptable states are evidence-based, which removes the incentive to hide devices.
- Median time from incident declaration to a documented notifiability decision, taken from the case management system timestamps. This directly tracks the nine-hour tabletop failure and is auditable by the regulator.
- Critical vulnerabilities remediated within the agreed SLA, by asset class, with exceptions listed rather than averaged, so a good clinic score cannot mask a bad device estate.
- Open accepted risks with owner and expiry date, plus how many expired this quarter. This forces the board to see what the EUR 3.8 million did not buy.
Each metric should be defined once in a board-approved glossary, sourced from a system of record, and reviewed by internal audit annually so the definition cannot drift toward flattery.