Board Statement After a Peer Ransomware Outage
A 320-bed regional hospital holds ISO/IEC 27001 certification and must answer a board question after a neighboring health system suffered a ransomware outage. The CISO proposes telling the board the hospital is NIST CSF certified and using the CSF as a replacement for the ISO management system. The hospital has 4,800 staff, 60 clinical applications, a 24/7 SOC outsourced to a managed provider, and an annual cyber budget of $2.1 million. The board wants a defensible statement about maturity and a 12-month plan. The CIO wants one framework only, arguing that maintaining both CSF and ISO 27001 duplicates work. A payer contract now requires evidence of a risk-based cybersecurity program aligned to a recognized framework but does not name a specific one. The hospital has no current CSF profile and last completed a formal risk assessment 18 months ago.
1. How should the CISO respond to the board's request for a statement about NIST CSF certification?
Read the worked answer
The CISO should correct the premise before it reaches the board minutes. The NIST Cybersecurity Framework is voluntary, outcome-based guidance; it has no certification scheme, no accreditation body, and no certificate to display. Saying the hospital is 'NIST CSF certified' would be inaccurate and could create legal and reputational exposure if a payer or regulator asks for the certificate. The defensible statement is narrower: the hospital uses CSF 2.0 to organize cybersecurity outcomes, has a current profile and a target profile, and manages gaps through a risk-based plan. ISO/IEC 27001 is the certifiable artifact because it certifies a management system, not a specific set of CSF outcomes. The board can be told the hospital is ISO 27001 certified and uses CSF to communicate risk, prioritize investments, and show alignment to a recognized framework. The CISO should also explain that a tier is a characterization of risk management rigor, not a certification or a maturity badge.
2. Should the hospital retire ISO/IEC 27001 to avoid duplicate work? Explain using CSF fundamentals.
Read the worked answer
Retiring ISO 27001 would be a poor trade if the certificate supports payer contracts, customer trust, or internal audit discipline. The two instruments answer different questions. ISO 27001 certifies that the hospital operates a documented information security management system with continual improvement. CSF 2.0 provides a common taxonomy of outcomes across Govern, Identify, Protect, Detect, Respond, and Recover, and it is explicitly designed to be used alongside other frameworks. Duplication is reduced by building a crosswalk from ISO controls to CSF subcategories, then using the CSF profile for board-level prioritization and the ISO management system for audit evidence and corrective action. The hospital should not treat CSF as a replacement management system; it lacks certification and prescriptive control requirements. A practical path is to keep ISO certification, create a CSF current profile, define a target profile tied to the 12-month plan, and map existing ISO evidence into both. That gives the board one risk narrative without discarding a certifiable control environment.
3. What evidence package should the hospital give the payer?
Read the worked answer
The payer asked for evidence of a risk-based program aligned to a recognized framework, not for a certificate. The package should include the CSF current profile and target profile, the scope and assumptions, the tier rationale, the most recent risk assessment, the prioritized gap plan with owners and dates, and evidence that executive leadership approved the risk appetite and plan. Supporting evidence can include the ISO 27001 certificate and audit results, but the cover statement must be precise: ISO certification is not CSF certification. The hospital should also show how it selected priorities, for example by mapping gaps to clinical service impact and regulatory obligations, and how it will measure progress, such as reduced time to detect, completed incident response tests, and closed high-risk gaps. If the payer requires a specific framework name, the response can state alignment to CSF 2.0 and describe the profile method. Honesty about scope and remaining gaps is more defensible than a claim of full alignment.