Third-Party and Vendor Risk Management: Your Security Is Only as Strong as Your Connections

Organizations rarely operate completely on their own.

They rely on software vendors, cloud providers, contractors, consultants, suppliers, payment processors, managed service providers, and many other outside organizations to conduct business.

These relationships can improve efficiency and provide services that would be difficult or expensive to maintain internally.

They can also introduce cybersecurity risk.

An organization may have strong passwords, multifactor authentication, endpoint protection, security awareness training, and carefully configured networks. But if a trusted vendor with access to organizational systems is compromised, attackers may be able to use that relationship to reach the organization.

This is why third-party and vendor risk management is an important part of cybersecurity and the CompTIA Security+ Security Program Management and Oversight domain.

Cybersecurity does not stop at the organization's front door.

What Is Third-Party Risk?

A third party is an outside organization or individual that provides a product or service to an organization.

Examples can include:

• Software companies

• Cloud service providers

• Contractors

• Consultants

• Managed service providers

• Payroll companies

• Equipment suppliers

• Internet service providers

• Data storage providers

• Payment processors

• Temporary staffing companies

A third party may have access to organizational systems, facilities, networks, or information.

That access creates risk.

For example, imagine a company hires a vendor to remotely maintain an important application.

The vendor receives remote access to the organization's network.

If an attacker compromises the vendor's credentials, the attacker may attempt to use those credentials to access the customer's systems.

The organization is therefore affected by the vendor's security practices as well as its own.

Why Attackers Target Vendors

Attackers understand that large organizations may have sophisticated security controls.

Instead of attacking the organization directly, they may search for another route.

A smaller vendor may have:

• Weaker security controls

• Limited cybersecurity staffing

• Poor password practices

• Outdated software

• Excessive account privileges

• Inadequate monitoring

If that vendor has trusted access to another organization, compromising the vendor could provide attackers with a path into the larger target.

This is sometimes associated with a supply-chain attack.

Rather than attacking the final target directly, an attacker compromises a trusted product, service, supplier, or business relationship.

The Supply Chain Is Larger Than You Think

When people hear the term “supply chain,” they may think about trucks, warehouses, and physical products.

In cybersecurity, the supply chain can include software and digital services.

For example, an organization may use:

• A cloud-based email platform

• Electronic records systems

• Remote support software

• Security applications

• Payroll services

• Collaboration platforms

• Backup services

• Software libraries

• Hardware containing third-party components

Each dependency introduces another relationship that should be understood.

A single application may even depend on dozens of other software components.

This is one reason supply-chain security has become such an important cybersecurity concern.

Vendor Risk Begins Before the Contract

Vendor security should ideally be evaluated before a vendor receives access to organizational systems or information.

This process is sometimes called vendor due diligence.

Organizations may ask potential vendors questions such as:

• What security controls are implemented?

• Is multifactor authentication required?

• How is customer information encrypted?

• Who can access customer data?

• How quickly are vulnerabilities patched?

• How are security incidents detected?

• How will customers be notified of a breach?

• Are security assessments performed?

• Are employees provided cybersecurity training?

• Are background checks performed when appropriate?

• Does the vendor use subcontractors?

• Where is customer information stored?

• How long is information retained?

• What happens to customer information when the contract ends?

The level of review should generally reflect the level of risk.

A company providing office furniture probably does not require the same cybersecurity review as a company storing confidential organizational information.

Security Questionnaires and Assessments

Organizations may use security questionnaires when evaluating vendors.

These questionnaires help

Cybersecurity Risk Management: Identifying, Assessing, and Responding to Risk

 

Cybersecurity is not about eliminating every possible risk.

That would be nearly impossible.

Every organization faces cybersecurity risks from phishing attacks, malware, stolen passwords, outdated software, lost devices, system failures, third-party vendors, human mistakes, and many other sources.

The goal of cybersecurity risk management is to understand those risks, determine which ones could have the greatest impact, and decide what should be done about them.

Risk management is not just something performed by executives, cybersecurity professionals, or auditors. Employees play an important role because they often encounter risks during their everyday work.

Recognizing a suspicious email, reporting an unusual login notification, questioning an unexpected request for confidential information, or reporting a lost device can all be forms of risk management.

Understanding how cybersecurity risk works can help everyone make better security decisions.

What Is Cybersecurity Risk?

In simple terms, cybersecurity risk is the possibility that a threat could take advantage of a vulnerability and cause harm.

Three important concepts are involved:

Threat – Something capable of causing harm.

Vulnerability – A weakness that could be exploited.

Impact – The damage that could occur if the threat successfully exploits the vulnerability.

Consider a simple example.

An attacker sends an employee a phishing email.

The attacker represents the threat.

If the employee's account does not have adequate authentication protections, that could represent a vulnerability.

If the attacker successfully steals the employee's credentials, the impact could include unauthorized access to email, confidential information, or organizational systems.

Risk management asks an important question:

How likely is this to happen, and how serious would the consequences be?

Risk Is Everywhere

Organizations cannot operate without accepting some level of risk.

Using email creates risk.

Connecting computers to the internet creates risk.

Allowing remote work creates risk.

Using cloud applications creates risk.

Giving employees access to information creates risk.

Even installing security software introduces some operational risk if that software causes compatibility problems or system outages.

The goal is not to avoid technology or prevent employees from doing their jobs.

The goal is to understand the risks associated with technology and reduce them to an acceptable level.

Identifying Risk

The first step in risk management is identifying what could go wrong.

Organizations may identify risks through:

• Security assessments

• Vulnerability scans

• Penetration testing

• Audits

• Incident reports

• Employee reports

• Threat intelligence

• Vendor assessments

• Security monitoring

• Lessons learned from previous incidents

Employees can also identify risks during everyday work.

For example, an employee might notice that confidential documents are being stored in an inappropriate location.

Someone might notice that a shared account is being used by several employees.

Another employee might discover that a former employee still appears to have access to a system.

These observations should not be ignored simply because they have not caused an incident yet.

A vulnerability does not have to be actively exploited before it becomes important.

Reporting it gives the organization an opportunity to address the problem before something happens.

Assessing Risk

Once a risk has been identified, the organization needs to understand how significant it is.

Risk assessments commonly consider two major factors:

Likelihood: How likely is the event to occur?

Impact: How serious would the consequences be?

Imagine two vulnerabilities.

The first affects a computer that contains no sensitive information, is rarely used, and is isolated from important systems.

The second affects an internet-facing system containing confidential information.

Even if the technical vulnerability is similar, the risk may be very different because the potential impact and exposure are different.

This is why organizations prioritize cybersecurity risks rather than treating every issue exactly the same.

Qualitative and Quantitative Risk

Organizations may evaluate risk using either qualitative or quantitative methods.

Qualitative Risk Analysis

Qualitative analysis uses descriptive categories.

For example:

Low

Medium

High

Critical

An organization might determine that a vulnerability has a high likelihood of exploitation and a high potential impact.

This method is relatively easy to understand and communicate.

Quantitative Risk Analysis

Quantitative analysis attempts to assign numerical values to risk.

Organizations may estimate financial losses associated with security incidents.

For example, they might consider:

• Lost productivity

• Recovery costs

• Legal expenses

• Regulatory penalties

• Replacement equipment

• Lost revenue

• Incident response expenses

Security+ also introduces several important quantitative risk concepts.

Single Loss Expectancy

Single Loss Expectancy (SLE) estimates how much an organization could lose from one occurrence of an incident.

The basic formula is:

SLE = Asset Value × Exposure Factor

Suppose an organization has a system valued at $100,000 and estimates that a particular incident would result in a 25% loss.

The SLE would be:

$100,000 × 25% = $25,000

The estimated loss

Security Policies, Standards, Procedures, and Guidelines: Why They Matter

Cybersecurity is often associated with firewalls, antivirus software, multifactor authentication, encryption, and other technical protections. While these technologies are important, technology alone cannot protect an organization.

People also need to know what is expected of them, what rules they must follow, and what actions they should take when something goes wrong.

That is where security policies, standards, procedures, and guidelines come into play.

These documents create the framework employees and organizations use to make consistent security decisions. They are also an important part of Security Program Management and Oversight, a major area covered by the CompTIA Security+ certification.

Understanding the difference between these documents may sound administrative, but they have a direct impact on everyday cybersecurity.

Security Starts With Expectations

Imagine starting a new job and being given access to email, computers, applications, confidential information, and company resources—but nobody explains the security rules.

Can you use your personal email to send company documents?

Can you install software?

How quickly should you report a suspicious email?

Can you connect a personal USB drive?

What happens if you accidentally send confidential information to the wrong person?

Without clearly documented expectations, employees may make different decisions based on what they believe is appropriate. Even well-intentioned decisions can create security risks.

Security documentation helps eliminate that uncertainty.

Four common types of security documentation are:

Policies – What must be done

Standards – What specific requirements must be followed

Procedures – How something is done

Guidelines – What is recommended

Although these documents work together, they serve different purposes.

Security Policies: Setting the Rules

A security policy establishes an organization's overall security expectations and requirements.

Policies generally answer the question:

“What are we required to do?”

For example, an organization may have an Acceptable Use Policy stating that employees must use organizational technology resources appropriately and securely.

Other common security policies include:

• Acceptable Use Policy
• Information Security Policy
• Password Policy
• Remote Access Policy
• Data Classification Policy
• Incident Response Policy
• Mobile Device Policy
• Email and Communication Policy

A policy typically establishes the rule without describing every technical step necessary to follow it.

For example:

Employees must use multifactor authentication when accessing designated organizational systems.

That establishes the requirement.

The instructions for enrolling a phone or security key in MFA would normally appear in a procedure, not the policy itself.

Policies provide consistency and help ensure everyone understands the organization's security expectations.

Security Standards: Defining the Requirements

If a policy tells employees what must happen, a standard provides more specific requirements for meeting that policy.

Standards help create consistency across an organization.

For example, a password policy might state:

Organizational accounts must be protected using strong passwords.

A password standard could then define what “strong” means:

• Minimum password length
• Required authentication controls
• Password reuse restrictions
• Account lockout requirements
• Multifactor authentication requirements

Standards can also define technical configurations.

For example, an organization may establish standards for:

• Encryption
• Laptop configurations
• Operating system versions
• Network security
• Software patching
• Endpoint protection
• Cloud security
• Data retention

Without standards, two departments could interpret the same security policy very differently.

Standards create a consistent baseline.

Procedures: Explaining How to Do It

A procedure provides step-by-step instructions for completing a task.

Procedures answer the question:

“How do I do this correctly?”

For example, an organization may have an incident response policy requiring employees to report suspected cybersecurity incidents.

The procedure could explain:

1. Stop interacting with the suspicious message or system.
2. Do not delete potential evidence.
3. Contact the IT or security team.
4. Provide the device name and a description of what occurred.
5. Follow instructions from the incident response team.

Procedures are especially important when employees need to respond quickly.

During a cybersecurity incident, people may be stressed or uncertain about what to do. A documented procedure gives them clear instructions instead of forcing them to improvise.

Common security procedures include:

• Reporting phishing messages
• Resetting passwords
• Requesting system access
• Responding to lost or stolen devices
• Reporting security incidents
• Onboarding employees
• Offboarding employees
• Restoring data from backups
• Installing approved software
• Handling sensitive information

Good procedures should be clear enough that someone unfamiliar with the process can follow them correctly.

Guidelines: Providing Recommended Practices

A guideline provides recommendations rather than mandatory requirements.

Guidelines answer the question:

“What is the recommended way to do this?”

For example, an organization might provide guidelines recommending that employees avoid using public Wi-Fi when working with sensitive information.

Guidelines may include recommendations for:

• Working remotely
• Protecting mobile devices
• Creating secure home networks
• Identifying phishing attempts
• Protecting information while traveling
• Using collaboration tools securely

Guidelines provide flexibility.

Technology and working environments change quickly, so organizations may use guidelines to encourage good security practices without creating a mandatory requirement for every situation.

How They Work Together

Policies, standards, procedures, and guidelines should not operate independently.

Think of them as layers.

Policy: Employees must protect organizational accounts.

Standard: Accounts must meet established authentication requirements.

Procedure: Follow these steps to enroll in multifactor authentication.

Guideline: Consider using an approved password manager to help maintain unique passwords.

Together, these documents create a security framework employees can understand and follow.

Why Employees Should Care

It can be easy to think security policies exist only for IT, cybersecurity teams, auditors, or management.

They do not.

Employees are often the people who encounter security threats first.

An employee may receive the phishing email.

An employee may notice unusual computer behavior.

An employee may accidentally send information to the wrong recipient.

An employee may discover that a device is missing.

An employee may receive an unexpected MFA request.

Knowing organizational security expectations can make the difference between a minor security event and a serious incident.

Consider an unexpected MFA notification.

An employee who understands the organization's security procedures knows not to approve the request and knows how to report it.

Someone unfamiliar with those procedures might approve the request simply to make the notification disappear.

That single decision could allow an attacker to access an organizational account.

Policies Must Evolve

Security policies cannot simply be written once and forgotten.

Technology changes.

Threats change.

Business operations change.

Regulatory requirements change.

Organizations adopt new cloud services, mobile devices, artificial intelligence tools, collaboration platforms, and remote-work technologies.

Security documentation should therefore be reviewed regularly.

Organizations should consider questions such as:

• Does this policy still reflect how employees work?
• Have new technologies been introduced?
• Are employees able to understand the requirements?
• Have security incidents exposed gaps in existing procedures?
• Have legal or regulatory requirements changed?
• Are procedures still technically accurate?

Outdated security documentation can sometimes be almost as problematic as having no documentation at all.

If employees repeatedly discover that procedures are inaccurate, they may stop trusting the documentation entirely.

Employees Play a Role in Improving Security

Employees should not be afraid to point out security processes that are unclear or outdated.

If a procedure does not work, tell IT or the security team.

If a policy is confusing, ask for clarification.

If instructions reference systems that are no longer used, report it.

If you discover a security situation that is not covered by an existing procedure, bring it to someone's attention.

Cybersecurity programs improve when employees communicate problems instead of quietly creating workarounds.

Security Is a Shared Responsibility

Policies and procedures are not meant to create unnecessary obstacles. Their purpose is to establish predictable and secure ways of working.

The strongest cybersecurity programs combine three important elements:

People

Processes

Technology

Technology provides protection.

Processes provide consistency.

People make security decisions every day.

Understanding security policies, standards, procedures, and guidelines helps employees recognize what is expected of them and what they should do when something unexpected occurs.

The next time you encounter a security policy or procedure, do not think of it as paperwork.

Think of it as part of the organization's security defenses.

Because cybersecurity does not begin when an incident occurs.

It begins with knowing what to do before the incident ever happens.

---

Knowledge Check

1. What is the primary purpose of a security policy?

A. Provide step-by-step technical instructions
B. Establish organizational security expectations and requirements
C. Recommend optional security practices
D. Document hardware inventory

Answer: B

2. Which document normally provides specific mandatory requirements supporting a policy?

A. Guideline
B. Procedure
C. Standard
D. Newsletter

Answer: C

3. Which document explains how to perform a security-related task?

A. Procedure
B. Policy
C. Guideline
D. Standard

Answer: A

4. Which document generally provides recommended rather than mandatory practices?

A. Policy
B. Standard
C. Procedure
D. Guideline

Answer: D

5. An employee receives an unexpected MFA approval request. What is the best response?

A. Approve it to stop the notifications
B. Ignore all future MFA requests
C. Deny the unexpected request and follow the organization's security reporting procedure
D. Disable MFA

Answer: C

Key Takeaway

Remember this simple Security+ distinction:

Policy = What must be done
Standard = Specific requirements
Procedure = How to do it
Guideline = Recommended practice

Knowing the difference is useful for the Security+ exam—but more importantly, understanding and following these documents helps protect employees, information, systems, and the organization itself.

 

 

When Technology Goes Down: Business Continuity and Disaster Recovery

Introduction

Technology has become an essential part of nearly every job. We depend on computers, email, phones, networks, cloud applications, electronic health records, shared files, and other systems to complete our daily work. In healthcare, these technologies can also directly support patient care, communication, scheduling, documentation, and access to critical information.

But what happens when that technology suddenly becomes unavailable?

A power outage, hardware failure, cyberattack, ransomware infection, network outage, natural disaster, or even a simple configuration mistake can interrupt normal operations. When that happens, an organization needs more than an IT team working to fix the problem. It needs a plan for continuing essential operations while technology is unavailable and safely restoring systems afterward.

This is where Business Continuity and Disaster Recovery, often referred to as BC/DR, come into play.

While these terms are frequently used together, they represent two different but closely connected responsibilities.

Business Continuity focuses on keeping essential operations functioning during a disruption.

Disaster Recovery focuses on restoring technology, systems, applications, and data following that disruption.

Together, they help an organization remain resilient when the unexpected happens.

What Is Business Continuity?

Business continuity is an organization's plan for maintaining critical operations when normal processes or technology are unavailable.

Imagine arriving at work and discovering that a critical application cannot be accessed. Employees may still need to communicate, assist patients, document information, coordinate services, or perform other essential responsibilities.

A business continuity plan answers an important question:

How do we continue working safely until normal operations are restored?

Depending on the department and type of outage, this could involve using established downtime procedures, alternative communication methods, approved paper forms, backup locations, or temporary manual processes.

Business continuity is not about pretending nothing happened. It is about maintaining the most important functions while recognizing that normal processes may temporarily change.

What Is Disaster Recovery?

Disaster recovery is more technology focused.

It addresses how IT systems, applications, networks, servers, and data are restored following a significant disruption.

Disaster recovery planning may include restoring information from backups, rebuilding servers, replacing failed equipment, recovering cloud services, restoring network connectivity, or moving operations to backup infrastructure.

One of the most important parts of disaster recovery is determining which systems should be restored first.

Not every system has the same level of importance.

Organizations should identify systems that are critical to patient care, safety, communication, and business operations and establish recovery priorities before an emergency occurs.

Trying to make those decisions for the first time during a major outage can slow the response.

What Can Cause a Major Technology Disruption?

When people hear the word "disaster," they may picture earthquakes, floods, fires, or severe weather. Those events certainly belong in disaster recovery planning, but technology disruptions can happen for many other reasons.

A cyberattack could encrypt important files. A software update could cause a critical application to fail. Network equipment could malfunction. A cloud provider could experience an outage. A construction accident could damage a communications line. A power failure could affect an entire facility.

Human error can also cause significant outages.

An incorrect configuration or accidental change can sometimes affect hundreds or thousands of users.

This is why business continuity and disaster recovery planning should consider many different scenarios rather than focusing on a single type of emergency.

Why BC/DR Matters in Healthcare

Technology downtime can create challenges in any industry, but healthcare organizations have additional concerns.

Employees may rely on technology to access patient information, communicate with other departments, review schedules, process medications, document care, coordinate appointments, or perform administrative functions.

When systems become unavailable, the organization must continue protecting patient safety and sensitive information while working under unusual circumstances.

A successful continuity plan helps employees understand what procedures should be followed when normal systems cannot be used.

This is especially important because an emergency is not the ideal time to discover that employees do not know the downtime process.

Preparation reduces confusion.

Backups: An Essential Part of Recovery

Backups are one of the most important components of disaster recovery.

A backup creates a separate copy of information that may be used if the original data becomes unavailable, corrupted, accidentally deleted, or encrypted by ransomware.

However, simply having a backup is not enough.

Organizations also need to know that their backups work.

Backups should be protected, monitored, and tested periodically to confirm that information can actually be restored.

This is particularly important with ransomware. Attackers may attempt to compromise or delete backups before encrypting production systems.

A strong recovery strategy therefore considers not only whether backups exist, but also whether they are secure and recoverable.

Recovery Priorities

During a major outage, everyone naturally wants their system restored first.

Unfortunately, that may not be possible.

IT and organizational leadership may need to restore systems according to predetermined business and operational priorities.

Critical clinical systems, communications infrastructure, identity services, networking, or other foundational technology may need to be restored before less critical applications.

This means some departments could remain in downtime procedures even after other systems begin returning to service.

Employees should avoid attempting to bypass downtime procedures or create unauthorized workarounds simply because a system remains unavailable.

Those workarounds can introduce additional security, privacy, or data integrity problems.

Communication During an Outage

Good communication can make a significant difference during a technology disruption.

During a major outage, employees naturally want updates:

What happened?

How long will systems be unavailable?

What should I do?

Sometimes IT will not immediately know the answers.

Technical teams may first need to determine whether the outage was caused by hardware failure, a cybersecurity incident, a vendor issue, or another problem.

Employees should rely on established organizational communication channels and follow instructions provided by IT, leadership, emergency management, or other authorized teams.

Avoid spreading unconfirmed information or rumors about the cause of an outage.

During a cybersecurity investigation, some information may also need to remain confidential.

The Employee's Role in Business Continuity

Business continuity is not only an IT responsibility.

Employees should understand the downtime procedures that apply to their department.

This may include knowing where approved downtime forms are located, how to communicate if normal systems are unavailable, who to contact with questions, and how information created during downtime should later be entered into restored systems.

Employees should also know what not to do.

For example, do not move confidential information to personal email, personal cloud storage, USB devices, or unapproved applications simply because normal systems are unavailable.

An outage does not eliminate security or privacy requirements.

If you are unsure how to complete a task safely during downtime, ask your supervisor or follow your organization's established procedures.

Testing the Plan

A continuity plan that has never been tested may contain unexpected problems.

Organizations should periodically conduct exercises to determine whether their plans actually work.

These exercises might involve simulated network outages, ransomware scenarios, application failures, communication disruptions, or other emergencies.

Testing helps identify important questions.

Do employees know what to do?

Are emergency contact lists current?

Are backup systems working?

Can critical data be restored?

Are downtime procedures accessible when computers are unavailable?

Did everyone understand their responsibilities?

Finding these problems during an exercise is far better than discovering them during a real emergency.

Returning to Normal Operations

Recovery is not simply turning systems back on.

IT teams need to verify that systems are stable, secure, and functioning correctly before returning them to normal use.

After a cybersecurity incident, additional monitoring may also be necessary to make sure the threat has been eliminated.

Employees may then need to reconcile information that was collected during downtime.

For example, information recorded using approved manual procedures may need to be entered into electronic systems once they are restored.

Following the established recovery process helps prevent lost, duplicated, or inaccurate information.

Business Continuity Is Everyone's Responsibility

Technology failures are inconvenient, but preparation can prevent inconvenience from becoming chaos.

IT teams are responsible for maintaining and recovering technology, but successful business continuity requires participation throughout the organization.

Leadership establishes priorities.

Departments maintain downtime procedures.

IT restores systems.

Security teams investigate threats.

Employees follow established processes and report problems.

Everyone contributes to organizational resilience.

Conclusion

No organization can guarantee that its technology will always be available.

Hardware can fail. Power can disappear. Networks can go down. Vendors can experience outages. Cybercriminals can attack. Human mistakes can happen.

What organizations can control is how prepared they are to respond.

Business continuity provides a plan for maintaining essential operations during a disruption, while disaster recovery provides a structured approach for restoring the technology and information those operations depend on.

The goal is not simply to get computers working again.

The goal is to protect people, maintain essential services, preserve information, and return to normal operations safely.

Preparation today can make the difference between confusion and coordinated action tomorrow.

---

Knowledge Check

1. What is the primary purpose of Business Continuity?

A. Prevent all computer failures
B. Keep essential operations functioning during a disruption
C. Replace damaged computers
D. Investigate cybercriminals

Correct Answer: B

2. What does Disaster Recovery primarily focus on?

A. Restoring technology, systems, applications, and data
B. Employee scheduling
C. Physical building security
D. Preventing employees from using computers

Correct Answer: A

3. Why should backups be tested regularly?

A. To increase internet speed
B. To verify that information can actually be restored
C. To reduce the number of user accounts
D. To eliminate downtime procedures

Correct Answer: B

4. During a major outage, should employees create their own technology workarounds?

A. Yes, if it saves time
B. Yes, if personal email is available
C. No, employees should follow approved downtime procedures
D. Only if the outage lasts more than an hour

Correct Answer: C

5. Who is responsible for successful business continuity?

A. Only the IT department
B. Only management
C. Only cybersecurity staff
D. Everyone has a role

Correct Answer: D

IT Incident Response: Being Prepared When Something Goes Wrong

Introduction

In today’s digital workplace, technology touches almost everything we do. We rely on computers, applications, email, networks, cloud services, mobile devices, and electronic records throughout the workday. Because technology is so deeply connected to our operations, even a relatively small IT incident can quickly become a much larger problem.

An IT incident might be a suspicious email, malware infection, compromised account, lost device, system outage, accidental disclosure of information, or ransomware attack. Some incidents are caused by cybercriminals, while others may result from human error, equipment failure, software problems, or configuration mistakes.

The important question is not whether an organization will ever experience an IT incident. The question is: How prepared are we to respond when one happens?

That is where incident response comes in.

Incident response provides a structured process for identifying, managing, containing, and recovering from IT and cybersecurity incidents. A strong incident response program can reduce downtime, limit damage, protect sensitive information, and help an organization return to normal operations as safely and quickly as possible.

For employees, incident response is also an important reminder that cybersecurity is not solely the responsibility of the IT department. Everyone has a role.

What Is Incident Response?

Incident response is the organized process an organization follows when a technology or cybersecurity event occurs.

Think of an incident response plan as a playbook. When something unusual happens, the organization should not have to determine every step from scratch. There should already be procedures identifying who needs to be contacted, who investigates the incident, how systems may be isolated, how information is protected, and how services are restored.

Not every technical problem is necessarily a security incident. A printer that stops working, for example, may simply require normal troubleshooting. However, unusual behavior can sometimes indicate something more serious.

Examples of potential IT or security incidents include:

• A user clicking a phishing link and entering their password.
• Malware or ransomware being detected on a computer.
• An employee receiving an unexpected multifactor authentication request.
• Sensitive information being sent to the wrong recipient.
• A laptop or mobile device being lost or stolen.
• An unauthorized person accessing an account.
• Critical systems becoming unexpectedly unavailable.
• Unusual network activity or repeated login attempts.
• Files suddenly becoming encrypted, renamed, or inaccessible.
• An employee noticing activity on their computer that they did not initiate.

Recognizing and reporting these situations quickly can make an enormous difference.

Why Incident Response Matters

The longer a cybersecurity incident remains undetected, the more opportunity an attacker may have to access systems, steal information, spread malware, or compromise additional accounts.

This is particularly important in healthcare environments, where technology supports both business operations and patient care. A significant IT incident could interfere with access to applications, communications, scheduling, electronic health information, or other services employees depend on.

Cybersecurity incidents may also involve protected health information (PHI), personally identifiable information (PII), financial information, employee information, or confidential organizational data.

A well-prepared incident response program helps an organization minimize these risks while maintaining business continuity and protecting the people it serves.

The Six Phases of Incident Response

Although incident response programs can vary between organizations, the process generally follows several key phases.

1. Preparation

Effective incident response begins before an incident happens.

Preparation includes developing policies and procedures, assigning responsibilities, maintaining security tools, training employees, establishing communication plans, backing up critical information, and practicing incident response scenarios.

Organizations may also conduct tabletop exercises where teams walk through hypothetical incidents such as ransomware attacks or major system outages.

The goal is simple: when a real incident occurs, everyone should understand their responsibilities.

2. Detection and Analysis

The next step is recognizing that something unusual has happened.

Incidents may be detected through security monitoring tools, antivirus alerts, system logs, employee reports, external notifications, or unusual system behavior.

Once an incident is identified, IT and security teams begin analyzing what happened.

Questions may include:

What systems are affected? When did the activity begin? Which accounts are involved? Was sensitive information accessed? Is the threat still active? Could other devices be affected?

Employees can play an important role during this stage because they often notice unusual activity first.

3. Containment

Once an incident has been identified, the priority may be preventing it from spreading.

Containment could involve disconnecting a computer from the network, disabling an account, blocking malicious traffic, isolating servers, restricting access, or temporarily taking a system offline.

While these actions can sometimes be inconvenient, containment is intended to prevent a larger disruption.

This is also why employees should follow instructions from IT during an active incident. Something as simple as reconnecting a computer that IT intentionally isolated could interfere with the investigation or potentially allow malicious activity to continue.

4. Eradication

After the incident has been contained, the underlying threat must be removed.

Depending on the incident, this could involve removing malware, resetting passwords, closing unauthorized accounts, correcting system configurations, patching vulnerabilities, or rebuilding compromised devices.

The objective is not simply to make the immediate symptoms disappear. IT needs to determine the cause of the incident and address it so the same threat cannot immediately return.

5. Recovery

Recovery involves safely returning affected systems to normal operations.

Systems may be restored from backups, rebuilt, tested, patched, or monitored before being placed back into production.

IT teams may continue monitoring systems after recovery to make sure there are no signs that the attacker or malware has returned.

Restoring services quickly is important, but restoring them securely is even more important.

6. Lessons Learned

Incident response does not end when systems come back online.

After an incident, teams should review what happened and identify opportunities for improvement.

Did employees know whom to contact? Did monitoring tools detect the problem quickly enough? Were backups available? Were communication procedures effective? Could a policy, configuration, or technical control prevent the same problem in the future?

The purpose of this review is not simply to determine what went wrong. It is to make the organization stronger for the next incident.

What Employees Should Do

Employees are often the first line of detection.

If something does not look right, report it. Do not assume someone else has already noticed it.

If you receive a suspicious email, unexpected MFA request, unusual password-reset notification, strange pop-up, or other unexpected computer behavior, contact your IT or security team using your organization's established reporting process.

When reporting an incident, provide as much useful information as possible, including what happened, approximately when it happened, what device you were using, and what actions you took.

Most importantly, report mistakes quickly.

If you accidentally click a suspicious link, enter credentials on a questionable website, open a suspicious attachment, or send sensitive information to the wrong person, immediately notifying the appropriate team gives them the best opportunity to limit the impact.

Trying to hide or correct a security mistake independently can make the situation harder to investigate.

Communication During an Incident

Communication is critical during a major IT event.

Employees should rely on official organizational communication channels rather than rumors or speculation. During an investigation, IT may not immediately have every answer.

Incident responders may need time to determine what happened, what systems are affected, and what actions are necessary.

Employees should follow instructions carefully and avoid sharing information about an active incident outside authorized channels. Details about security incidents may be confidential and could potentially interfere with an investigation.

Building a Culture of Preparedness

Strong incident response requires more than security software.

It requires people, processes, and technology working together.

IT teams maintain systems and security controls. Leadership establishes policies and resources. Incident responders investigate threats. Employees help by recognizing suspicious activity, following procedures, and reporting concerns quickly.

Every reported phishing message, suspicious login, unusual computer behavior, or potential data exposure provides an opportunity to investigate a problem before it becomes larger.

Cybersecurity works best when employees feel comfortable reporting concerns without waiting until they are certain something is wrong.

When in doubt, report it.

Conclusion

IT incidents are an unavoidable part of operating in a connected world. Cyberattacks, system failures, human mistakes, and unexpected disruptions can happen even when strong security controls are in place.

What separates a manageable incident from a potentially serious disruption is often preparation and response time.

A strong incident response program helps organizations detect problems, contain threats, eliminate their causes, restore operations, and learn from what happened.

Employees are an essential part of that process.

By staying alert, reporting suspicious activity promptly, following IT instructions during incidents, and protecting organizational information, each of us contributes to a safer and more resilient workplace.

Remember: See something unusual? Report it. Fast reporting gives incident responders more time to protect our systems, our information, and the people we serve.

---

Knowledge Check

1. What is the primary purpose of an incident response plan?

A. Prevent every possible technology problem
B. Provide a structured process for responding to and recovering from incidents
C. Replace antivirus and security software
D. Allow employees to investigate incidents themselves

Correct Answer: B

2. What should you do if you accidentally enter your password on a suspicious website?

A. Wait to see if anything happens
B. Delete your browser history
C. Report it immediately using your organization's established process
D. Ignore it if multifactor authentication is enabled

Correct Answer: C

3. Why might IT disconnect a computer from the network during an incident?

A. To prevent the incident from spreading
B. To install optional software
C. To improve internet speed
D. To delete the user's files

Correct Answer: A

4. When does incident response end?

A. Immediately after malware is removed
B. As soon as the employee can use the computer again
C. After recovery and a review of lessons learned
D. Once the incident is reported

Correct Answer: C

5. Who has a role in effective incident response?

A. Only cybersecurity staff
B. Only IT administrators
C. Only management
D. Everyone in the organization

Correct Answer: D

Cybersecurity Risk: Why Every Employee Plays a Role in Protecting Our Organization

 

Cybersecurity is often associated with firewalls, antivirus software, passwords, and IT departments. While technology is certainly an important part of cybersecurity, some of the greatest cybersecurity risks organizations face involve something much more familiar: people and the everyday decisions we make.

Every email we open, link we click, password we create, file we share, and device we use can affect the security of our organization.

In healthcare, cybersecurity takes on even greater importance. We work with sensitive information, including patient information, employee information, financial records, operational information, and other confidential data. Protecting that information is not simply an IT responsibility. It is part of protecting the people we serve and maintaining their trust.

Understanding cybersecurity risk can help all of us make better decisions and recognize potential problems before they become security incidents.

What Is Cybersecurity Risk?

Cybersecurity risk is the possibility that a cyber threat could negatively affect an organization, its systems, its information, or the people it serves.

A risk does not necessarily mean that something bad has already happened. Instead, risk considers what could happen, how likely it is to happen, and what the impact could be if it does.

For example, receiving a phishing email does not automatically mean an account has been compromised. The risk comes from the possibility that someone might click the malicious link, provide their credentials, or open an infected attachment.

Organizations reduce cybersecurity risk through a combination of technology, policies, procedures, training, monitoring, and employee awareness.

No security system can eliminate every risk. The goal is to recognize risks and reduce them to an acceptable level.

Why Cybersecurity Risk Matters in Healthcare

Healthcare organizations are attractive targets for cybercriminals because of the amount and variety of information they maintain.

Patient records may contain names, addresses, dates of birth, insurance information, medical information, and other sensitive data. Organizations also maintain employee information, business records, financial information, credentials, and access to critical systems.

A cybersecurity incident can therefore have consequences far beyond a single computer.

A successful attack could potentially disrupt access to systems, delay patient services, expose confidential information, create financial losses, damage an organization's reputation, or interfere with normal business operations.

This is one reason cybersecurity and patient safety are increasingly connected.

When technology supports scheduling, communication, documentation, medications, treatment, and other healthcare operations, keeping those systems available and secure helps support safe and effective care.

People Are an Important Part of Cybersecurity

Cybercriminals understand that attacking technology directly can be difficult. Instead, they frequently attempt to manipulate people.

This is known as social engineering.

Phishing is one of the most familiar examples. An attacker may send an email designed to look like it came from a coworker, manager, vendor, bank, delivery company, or technology service.

The message may claim that your password is expiring, an invoice needs approval, a document has been shared with you, or your account will be disabled unless you act immediately.

The attacker wants you to react before you have time to think.

That is why urgency is such a common warning sign.

Before clicking a link or opening an attachment, consider whether the message makes sense. Look carefully at the sender. Be cautious when a message unexpectedly asks for credentials, financial information, confidential information, or immediate action.

If something does not seem right, verify it through a trusted method or report it.

Taking an extra minute to verify a suspicious message can prevent hours, days, or even weeks of work responding to a cybersecurity incident.

Passwords and Account Security

Passwords remain an important part of protecting organizational information.

A strong password should be difficult for another person or automated system to guess. Employees should follow organizational password requirements and avoid reusing work passwords for personal accounts.

Multifactor authentication, or MFA, provides another important layer of protection.

MFA requires another form of verification in addition to a password. This means that even if an attacker obtains someone's password, the attacker may still be unable to access the account.

However, MFA is not foolproof.

Attackers sometimes send repeated authentication requests hoping that a user will eventually approve one just to make the notifications stop. Never approve an MFA request you did not initiate.

Unexpected authentication prompts should be treated as potential warning signs and reported according to your organization's procedures.

Protect Information Based on Your Job Responsibilities

Access to information should be based on legitimate business needs.

Just because information is available through a system does not necessarily mean everyone should access it.

Employees should only access the information necessary to perform their job responsibilities and should only share information with individuals who are authorized to receive it.

This is particularly important when handling protected health information and other confidential information.

Before sending information, check the recipient carefully. Before sharing a file, confirm that the correct permissions have been assigned. Before discussing confidential information, consider who may be able to hear the conversation.

Small habits can prevent accidental disclosures.

Physical Security Is Cybersecurity Too

Cybersecurity is not limited to what happens online.

An unlocked computer can provide access to applications and information. A lost laptop, smartphone, or removable storage device can create a security risk. Printed documents left unattended may expose confidential information.

Lock your computer whenever you step away, even if you expect to be gone for only a few minutes.

Keep organization-owned equipment secure and report missing or stolen devices immediately.

Be aware of your surroundings when working with sensitive information, especially in public or shared spaces.

Physical security and information security work together.

Software Updates Matter

Updates sometimes feel inconvenient, but they serve an important security purpose.

Software vulnerabilities are weaknesses that attackers may be able to exploit. Once a vulnerability becomes known, software vendors may release a security update or patch to correct it.

Delaying required updates can leave systems exposed unnecessarily.

Employees can help by following organizational instructions regarding updates, restarts, and approved software.

Installing unauthorized applications can also introduce cybersecurity risks. Software downloaded from unknown or unapproved sources may contain malware or may not meet organizational security requirements.

When in doubt, contact IT before installing software or connecting unfamiliar equipment.

Reporting Quickly Reduces Risk

One of the most important cybersecurity habits is also one of the simplest:

Report suspicious activity quickly.

Sometimes employees hesitate because they are unsure whether something is actually a security problem.

You do not need to investigate it yourself.

If you receive a suspicious message, notice unusual activity, accidentally click something questionable, lose a device, or believe information may have been sent to the wrong person, report it through the appropriate organizational process.

Early reporting gives security and IT teams more time to investigate and potentially limit the impact.

Waiting can allow a small incident to become a much larger problem.

Cybersecurity Risk Is Also About Governance

Cybersecurity does not operate independently from the rest of an organization.

Governance provides the structure for determining how security decisions are made, who is responsible for those decisions, what policies must be followed, and how risks are managed.

Policies concerning passwords, acceptable use, access control, data handling, software installation, remote access, and incident reporting are not simply administrative requirements.

They are risk controls.

When employees follow those policies consistently, they help reduce organizational risk.

When employees bypass them because a shortcut seems faster or easier, they may unintentionally remove an important layer of protection.

Good cybersecurity governance depends on both leadership and employees doing their part.

Small Actions Make a Big Difference

You do not need to be a cybersecurity expert to improve security.

Every employee can reduce cybersecurity risk by practicing a few important habits:

• Think before clicking links or opening unexpected attachments.

• Use strong passwords and never share your credentials.

• Approve MFA requests only when you initiated the login.

• Lock your computer when stepping away.

• Access only the information needed to perform your job.

• Verify recipients before sending confidential information.

• Use approved software, devices, and storage locations.

• Complete required cybersecurity training.

• Follow organizational security policies and procedures.

• Report suspicious activity and potential mistakes promptly.

Individually, these actions may seem small. Collectively, they create multiple layers of protection that make it significantly more difficult for attackers to succeed.

Creating a Culture of Cybersecurity

Strong cybersecurity is not created by technology alone.

It develops when security becomes part of the organization's culture.

A strong security culture encourages employees to ask questions, report concerns, follow established procedures, and consider security when making everyday decisions.

It also recognizes that cybersecurity is not about creating fear. It is about awareness and responsibility.

Cybercriminals constantly adjust their methods. Technology changes. New vulnerabilities are discovered. New scams appear.

Our defenses must continue to evolve as well.

Technology provides important protection. Governance establishes expectations and accountability. Risk management helps identify where improvements are needed.

But people bring all of those pieces together.

Every time you recognize a phishing email, protect confidential information, lock your workstation, follow an established process, or report something suspicious, you contribute to the organization's cybersecurity defenses.

Knowledge Check

1. True or False: Cybersecurity risk is only the responsibility of the IT or cybersecurity department.

Answer: False. Cybersecurity is a shared responsibility. Every employee's actions can either reduce or increase organizational risk.

2. Which of the following could indicate a phishing attempt?

A. An unexpected attachment
B. A request for your password
C. A message creating unusual urgency
D. All of the above

Answer: D — All of the above.

3. True or False: If you accidentally click a suspicious link but nothing appears to happen, there is no reason to report it.

Answer: False. Report suspicious activity promptly so IT or security personnel can determine whether additional action is necessary.

4. Why should you lock your workstation when stepping away?

A. To save electricity
B. To prevent unauthorized access
C. To install updates
D. To improve computer performance

Answer: B — Locking your workstation helps prevent unauthorized access to systems and information.

5. What should you do if you receive an MFA approval request that you did not initiate?

A. Approve it to stop the notification
B. Ignore repeated requests indefinitely
C. Do not approve it and report the unexpected request
D. Ask a coworker to approve it

Answer: C — An unexpected MFA request could indicate that someone has obtained your credentials and is attempting to access your account.

Together, We Reduce Cybersecurity Risk

Cybersecurity risk cannot be completely eliminated, but it can be managed.

Technology, governance, policies, and security teams provide important protections, but employees remain one of the strongest layers of defense.

The next time you receive an unexpected email, access sensitive information, send a document, approve an authentication request, or step away from your computer, remember that your decision matters.

Think before you click. Protect information. Follow established processes. Speak up when something does not look right.

Cybersecurity is a shared responsibility, and small actions performed consistently can make a significant difference.

Secure today. Healthy tomorrow.

September Cybersecurity Awareness: Governance, Risk, and Your Role in Keeping Healthcare Secure

Cybersecurity can sometimes feel like something that belongs entirely to the IT department. We hear terms like firewalls, encryption, ransomware, governance, risk assessments, and network security, and it is easy to assume those things happen behind the scenes.

But some of the most important cybersecurity decisions happen at your desk every day.

Opening an email, clicking a link, accessing patient information, approving a multifactor authentication request, locking your computer, reporting something suspicious, or deciding whether to share information are all cybersecurity decisions.

In healthcare, those everyday decisions are especially important because we are responsible for protecting sensitive information and maintaining systems that people depend on.

For this September Cybersecurity Awareness training, we are focusing on three things that work together:

Cybersecurity, governance, and risk.

You do not need to be an IT professional to understand them - and you have an important role in all three.

What Is Cybersecurity Governance?

The word governance can make cybersecurity sound more complicated than it really is.

Governance is essentially how an organization establishes the rules, responsibilities, policies, and processes used to protect its information and technology.

Think about some of the security requirements you encounter at work:

• Using multifactor authentication (MFA)
• Following password requirements
• Locking your computer when you step away
• Using approved applications and equipment
• Protecting patient and confidential information
• Completing cybersecurity training
• Reporting suspicious emails
• Installing required updates
• Following procedures for accessing organizational systems

These requirements are not random.

They are part of a larger process designed to manage cybersecurity risk and protect our organization.

Governance also creates accountability. Leadership establishes expectations, IT and security teams implement protections, managers help reinforce policies, and employees follow established procedures.

Everyone has a role.

What Does "Risk" Mean?

We deal with risk every day, even when we do not call it risk management.

In cybersecurity, risk is the possibility that something could happen that negatively affects our information, technology, operations, or the people we serve.

Imagine receiving an email that appears to be from someone you know. The message says you need to review an urgent document and provides a link.

You click the link.

A login page appears.

You enter your username and password.

Unfortunately, the email was a phishing message and the login page was fake.

Your password may now be in the hands of an attacker.

That single action can create significant risk.

The attacker may attempt to access your email, organizational applications, confidential information, or other systems.

This is why cybersecurity risk management is not limited to technical systems. Our everyday decisions can either increase or reduce risk.

Stop Before You Click

One of the simplest cybersecurity habits is also one of the most effective:

Stop and look before you click.

Cybercriminals want us to react quickly.

They frequently create messages designed to make us worried, curious, excited, or rushed.

You might receive a message saying:

"Your password expires today."

"Your account will be disabled."

"You have an unpaid invoice."

"Review this confidential document immediately."

"Your package could not be delivered."

"Click here to listen to your voicemail."

The goal is to get you to react before you have time to think.

Before clicking a link or opening an unexpected attachment, look at the message carefully.

Do you recognize the sender?

Were you expecting the message?

Does the sender's email address look correct?

Does the request make sense?

Is the message creating unusual urgency?

Is someone asking for information they normally would not request?

When something does not seem right, do not guess. Verify it.

Protect Your Password - and Your MFA

Your password is one of the keys to your digital identity.

Never share it with another employee, supervisor, coworker, friend, or anyone claiming to be technical support.

You should also never provide your password through email or in response to an unexpected request.

Multifactor authentication adds another layer of security, but MFA only protects your account when you use it correctly.

Suppose you are sitting at your desk and suddenly receive an MFA approval request on your phone.

You are not trying to log in.

What should you do?

Do not approve it.

An unexpected authentication request could mean someone has obtained your password and is attempting to access your account.

Deny the request and report the suspicious activity according to your organization's procedures.

Never approve an MFA notification simply because it appears on your device.

HIPAA and Cybersecurity Go Together

In healthcare, cybersecurity also helps us protect protected health information, or PHI.

HIPAA establishes requirements for safeguarding patient information, including electronic protected health information.

But protecting PHI is not something that happens only because a policy exists.

It happens because employees make good decisions throughout the day.

Before accessing patient information, ask:

Do I need this information to perform my job?

Access to information should be based on your job responsibilities and legitimate business needs.

The fact that you can access something does not necessarily mean you should.

The same principle applies when sharing information.

Always verify recipients before sending sensitive information, follow approved procedures for transmitting confidential information, and never use unauthorized applications or personal accounts to store or share organizational information.

Lock It Before You Leave It

You are called away from your desk for what you think will be thirty seconds.

Do you really need to lock your computer?

Yes.

It only takes a few seconds for someone to view information displayed on an unattended screen or interact with an unlocked computer.

Make locking your workstation a habit.

Every time you walk away, lock it.

This is one of the easiest cybersecurity protections employees can control themselves.

Don't Ignore Updates and Security Messages

Updates can be inconvenient, especially when you are busy.

However, many updates contain security fixes for vulnerabilities that could otherwise be exploited.

When IT requires an update, restart, security application, or other change, there is usually a reason.

Avoid delaying required updates unnecessarily, disabling security software, or attempting to bypass security controls.

Also, do not install software simply because you found something online that would make a task easier.

Unauthorized applications can introduce security vulnerabilities, licensing problems, privacy concerns, or malicious software.

If you need software that is not currently available, follow your organization's process for requesting it.

Report It - Even If You Made the Mistake

This may be one of the most important lessons in this month's training.

If something happens, report it quickly.

Maybe you clicked a link and then realized the email looked suspicious.

Maybe you entered your password before realizing the website was not legitimate.

Maybe you accidentally sent information to the wrong person.

Maybe you approved an MFA request and then realized you were not trying to log in.

Maybe your computer suddenly begins behaving strangely.

Do not wait to see what happens.

Do not try to hide the mistake.

And do not assume that because nothing happened immediately, everything is fine.

Report the incident using your organization's established process as soon as possible.

Quick reporting gives IT or cybersecurity staff an opportunity to investigate and take action.

They may be able to reset credentials, disable an account, block a malicious website, isolate a device, remove a suspicious email, or prevent an attacker from moving farther into the environment.

A small mistake does not necessarily have to become a major cybersecurity incident.

But delaying the report can give an attacker more time.

Cybersecurity Is Also About Patient Care

Cybersecurity in healthcare is about much more than protecting computers.

Consider what could happen if a cyberattack suddenly made important systems unavailable.

Employees might lose access to electronic health records.

Appointments could be affected.

Communication systems might become unavailable.

Clinical staff could have difficulty accessing information they need.

Business operations could be interrupted.

A cybersecurity incident can become an operational issue and, in some circumstances, a patient-care issue.

That is why protecting our systems is part of protecting the people we serve.

Your September Cybersecurity Challenge

During September, challenge yourself to become more aware of the small cybersecurity decisions you make each day.

Before clicking a link, stop and look.

Before sending sensitive information, verify the recipient.

Before approving an MFA request, make sure you initiated it.

Before walking away from your computer, lock your screen.

Before installing software, make sure it is approved.

Before accessing information, make sure you have a legitimate business need.

And when something suspicious happens, report it quickly.

You do not have to understand every technical aspect of cybersecurity to make a difference.

Cybersecurity governance establishes the rules.

Risk management helps identify what needs to be protected.

Technology provides important safeguards.

But employees provide another critical layer of defense.

Every suspicious email you report, every workstation you lock, every unexpected MFA request you deny, and every moment you take to verify before clicking helps reduce cybersecurity risk.

Remember

Stop. Think. Verify. Report.

Those four actions can prevent a small cybersecurity mistake from becoming a much larger incident.

Cybersecurity is everyone's responsibility, and in healthcare, protecting information is part of protecting the people we serve.

 
September Cybersecurity Awareness Knowledge Check

Complete the following questions after reviewing this month's Cybersecurity, Governance, and Risk training.

1. Who is responsible for cybersecurity within a healthcare organization?

A. Only the IT department
B. Only managers and supervisors
C. Every employee
D. Only employees who work with patient records

Correct Answer: C -  Every employee

Cybersecurity is a shared responsibility. Every employee can help protect organizational systems, confidential information, and the people we serve.

---

2. You receive an unexpected email asking you to click a link and immediately verify your password. What should you do?

A. Click the link because the request is urgent
B. Reply to the email and ask if it is legitimate
C. Verify the request through a trusted method and report the email if it appears suspicious
D. Forward the email to a coworker and ask them to try the link

Correct Answer: C -  Verify the request through a trusted method and report the email if it appears suspicious

Cybercriminals frequently use urgency to encourage people to act without thinking. Stop, examine the message, and verify unexpected requests before taking action.

---

3. You receive an MFA approval request on your phone, but you are not trying to log in. What should you do?

A. Approve it because it may be an automatic system request
B. Approve it and change your password later
C. Ignore it
D. Deny the request and report the suspicious activity

Correct Answer: D -  Deny the request and report the suspicious activity

An unexpected MFA request could mean someone has obtained your password and is attempting to access your account.

---

4. True or False: If you have technical access to a patient's information, you may view the information even when it is unrelated to your job.

Correct Answer: False

Access should be based on your job responsibilities and a legitimate business need. Having access to information does not automatically mean you are authorized to view it.

---

5. Why should you lock your computer when stepping away from your workstation?

A. It saves electricity
B. It prevents unauthorized access to information and systems
C. It automatically installs updates
D. It improves computer performance

Correct Answer: B -  It prevents unauthorized access to information and systems

Even a short period away from an unlocked workstation can create an opportunity for unauthorized access.

---

6. Which of the following is an example of cybersecurity governance?

A. Organizational password and MFA requirements
B. Policies governing access to information
C. Procedures for reporting cybersecurity incidents
D. All of the above

Correct Answer: D -  All of the above

Governance establishes the policies, responsibilities, expectations, and processes an organization uses to manage cybersecurity and risk.

---

7. You accidentally click a suspicious link in an email. Nothing appears to happen. What should you do?

A. Delete the email and forget about it
B. Wait until the next day to see if your computer behaves differently
C. Report it immediately using your organization's established process
D. Restart your computer and continue working

Correct Answer: C -  Report it immediately using your organization's established process

Do not wait for visible signs of a problem. Quick reporting gives IT or cybersecurity staff an opportunity to investigate and respond before a potential incident becomes more serious.

---

8. True or False: Software found online can be installed on a work computer as long as it is free and appears legitimate.

Correct Answer: False

Only approved software should be installed on organizational devices. Unauthorized software may introduce malware, vulnerabilities, licensing issues, or privacy and security risks.

---

9. Which action can help reduce cybersecurity risk?

A. Verifying unexpected requests before responding
B. Reporting suspicious emails
C. Protecting passwords and MFA requests
D. Locking your workstation when you step away
E. All of the above

Correct Answer: E -  All of the above

Cybersecurity is strengthened through everyday actions. Small security habits can prevent much larger incidents.

---

10. Why is cybersecurity especially important in healthcare?

A. Healthcare organizations only need to protect computers
B. Cybersecurity protects patient information and helps maintain the availability of systems used to support healthcare operations and patient care
C. Cybersecurity is required only when an organization experiences a breach
D. Cybersecurity applies only to electronic health record administrators

Correct Answer: B -  Cybersecurity protects patient information and helps maintain the availability of systems used to support healthcare operations and patient care

A cybersecurity incident can affect confidential information, business operations, communication, and access to systems employees depend on to serve patients.

---

September Cybersecurity Takeaway

Remember these four actions throughout your workday:

STOP before clicking unexpected links or attachments.

THINK about whether a request makes sense.

VERIFY unusual requests using a trusted method.

REPORT suspicious activity or mistakes as quickly as possible.

Final Reminder

Cybersecurity governance provides the policies and expectations we must follow. Risk management helps the organization identify and address potential threats. Technology provides safeguards - but employees remain an important part of our defense.

Stop. Think. Verify. Report.

Every employee has a role in protecting our systems, our information, and the people we serve.