Hospital Vendor Risk Treatment and Residual Risk Acceptance
A 240-bed regional hospital runs its billing platform on a vendor-managed system that stores 380,000 patient records. The vendor reports a ransomware incident at a peer hospital and offers a SOC 2 Type II report covering only the last six months; the contract has no right-to-audit clause and a 72-hour breach notification window. The hospital's risk register estimates a single-loss expectancy of $2.4 million for a breach involving this platform and an annualized rate of occurrence of 0.15. A proposed compensating control - tokenized payment data plus 24/7 vendor log monitoring - costs $180,000 per year and is expected to reduce the annualized rate to 0.04. The CFO wants to accept the risk because the control exceeds the current cybersecurity budget by $60,000. The CISO must present a recommendation to the risk committee next week, and the hospital is subject to HIPAA but has no documented risk appetite statement.
1. Calculate the annualized loss expectancy before and after the proposed control, then recommend whether to fund it. Explain how the $60,000 budget gap should affect the decision.
Read the worked answer
ALE = SLE × ARO. Before: $2.4M × 0.15 = $360,000. After: $2.4M × 0.04 = $96,000. Expected loss avoided: $264,000. The control costs $180,000, so the net expected benefit is $84,000 per year. That makes the control economically justified on these assumptions, but the CISO should show sensitivity: if the control only halves the ARO to 0.095, avoided loss is only $132,000 and the control is not cost-effective. The $60,000 budget gap is a funding decision, not a reason to accept a $360,000 expected loss; the risk committee can reallocate, phase the control, or formally accept the residual. Recommend funding with a 12-month effectiveness review and a documented residual risk of $96,000. Because HIPAA requires risk management, the decision and assumptions must be recorded.
2. Who should formally accept the residual risk if the control is funded, and what should the acceptance record contain? Address the CISO, CFO, and risk committee roles.
Read the worked answer
Accountability should sit with the risk committee or board-level risk owner, not the CISO alone. The CISO recommends treatment and owns security operations; the CFO can accept financial consequences only within delegated authority. Without a risk appetite statement, the committee must set the acceptance threshold and record why $96,000 residual is tolerable. The acceptance record should include the risk scenario, inherent and residual ALE, SLE/ARO assumptions, control description and cost, control owner, residual risk owner, acceptance period, review triggers (vendor incident, audit finding, control failure), and monitoring evidence. It should also note HIPAA risk-analysis obligations and any budget decision. Time-bound acceptance prevents the risk from becoming permanent by default.
3. The vendor's SOC 2 Type II report covers six months and the contract lacks a right-to-audit. What assurance gaps remain, and what should the CISO request before relying on the report?
Read the worked answer
A six-month SOC 2 Type II report gives evidence only for its examination period and only for the systems in scope. The CISO should request the report's full scope, period, exceptions, management responses, complementary user entity controls, and subservice organizations. A bridge letter may cover the gap, but it is management assertion, not audit evidence. Because there is no right-to-audit, the hospital cannot independently verify the vendor's controls; request a contract amendment for audit rights, 24-hour incident notification, breach cooperation, and data return/destruction. Also request the latest penetration test summary, vulnerability remediation SLAs, and evidence that the peer-hospital incident was contained. SOC 2 is not a guarantee and does not replace a HIPAA business associate agreement or a vendor risk assessment.