The White House the week of July 10 released a federal plan for collaborating with the private sector and others to implement the National Cybersecurity Strategy. Released last March, the national strategy seeks to: strengthen collaboration with stakeholders to defend critical infrastructure; disrupt and dismantle threat actors; shape market forces to drive security and resilience; invest in a resilient future; and, forge international partnerships to pursue shared goals. It also aims to shift responsibility for cybersecurity from the end user to the owners and operators of data systems and realign incentives to favor long-term investments in security, resilience and promising new technologies.
“This ambitious implementation strategy seeks to merge and align government and private-sector cybersecurity efforts in a ‘whole of nation’ approach,” said John Riggi, AHA’s national advisor for cybersecurity and risk. “In general, these strategically aligned approaches will help protect our nation from foreign cyberthreats, which continue to accelerate in frequency, complexity and severity. We will be watching closely to see how minimum cyber standards will be applied to the health care sector, and how those standards align with the cyber threat landscape analysis conducted by the sector. We will also be monitoring whether any proposed cybersecurity requirements represent unfunded mandates on the health care field. As the government has stated, the primary responsibility for cybersecurity should rest with the developers of technology rather than the end users. Hospitals, as a sector, spend billions of dollars annually trying to secure the ‘insecure by default’ third-party technology necessary to provide patient care. Advanced cybersecurity features in third-party technology should not be an added expense — it should be as standard as seatbelts in vehicles.”
For more information on the National Cybersecurity Strategy or other cyber and risk issues, contact John Riggi at jriggi@aha.org. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity.
