Today, the U.S. Department of Health and Human Services (HHS), through the Administration for Strategic Preparedness and Response (ASPR), is releasing voluntary health care specific cybersecurity performance goals (CPGs) and a new gateway website to help Health Care and Public Health (HPH) sector organizations implement these high-impact cybersecurity practices and ease access to the plethora of cybersecurity resources HHS and other federal partners offer.
“We have a responsibility to help our health care system weather cyber threats, adapt to the evolving threat landscape, and build a more resilient sector,” said HHS Deputy Secretary Andrea Palm. “The release of these cybersecurity performance goals is a step forward for the sector as we look to propose new enforceable cybersecurity standards across HHS policies and programs that are informed by these CPGs.”
As outlined in the recent HHS Health Care Sector Cybersecurity concept paper, HHS is publishing the CPGs to help health care organizations, and health care delivery organizations in particular, prioritize implementation of high-impact cybersecurity practices. The HPH CPGs are designed to better protect the healthcare sector from cyberattacks, improve response when events occur, and minimize residual risk. HPH CPGs include both essential goals to outline minimum foundational practices for cybersecurity performance and enhanced goals to encourage adoption of more advanced practices.
“ASPR is leading this sector-wide effort to protect our nation’s health infrastructure against ever-increasing and complex cyber-attacks,” said Assistant Secretary for Preparedness and Response Dawn O’Connell. “The actions announced today make it easier for health care organizations to protect patients by prioritizing those key cybersecurity practices upon which they should focus their efforts.”
The HPH CPGs provide layered protection at different points of weakness in an organization’s technology environment, which is crucial to increase cyber resilience and ultimately protect patient safety. Layered defense provides redundancy so if one line of defense is compromised, additional layers exist as a backup to ensure that threats are stopped along the way.
Both the essential and enhanced goals were informed by common industry cybersecurity frameworks, best practices, and strategies (e.g., Health Industry Cybersecurity Practices, NIST Cybersecurity Framework, and the National Cybersecurity Strategy and Implementation Plan), and are designed to directly address common attack vectors against U.S. domestic hospitals as identified in the 2023 Hospital Cyber Resiliency Landscape Analysis. As an example, according to the Landscape Analysis, 80% of cyber-attacks are identity-based (e.g., social engineering), compromising legitimate credentials to move laterally within organizations. Several essential CPGs including implementing basic cybersecurity training, implementing email security measures, and revoking credentials for departing workforce members are relatively lower cost, high yield actions to protect organizations from identity-based attacks. The more intensive enhanced goals like network segmentation prevent threat actors from moving laterally within organizations when they are compromised.
Back to HCB News
