Resilience Has to Become a Clinical Conversation

Another concept that generated significant interest was the “Minimum Viable Organization.”

Originally framed in the research as the “Minimum Viable Hospital,” the concept was broadened to recognize that Health-ISAC member organizations include hospitals, clinics and other healthcare facilities.

The question is straightforward but difficult:

What must an organization still be capable of doing safely when major systems are unavailable for days—or potentially weeks?

The CISO Summit material intentionally frames the issue around a 14-day EMR and pharmacy outage. That is a very different exercise from traditional disaster-recovery planning.

Participants discussed the limitations of familiar downtime procedures such as manual charting. Those procedures may work for several hours. But what happens after two days? A week? Three weeks?

At that point, recovery cannot simply be measured by how quickly servers come back online. It has to be measured against the organization’s ability to continue providing safe care to vulnerable patients.

The benchmarking data reinforces the concern. Only 22% of organizations rate their NIST “Recover” maturity at Level 4 or 5, while 26% remain at Level 1 or 2. Health-ISAC identifies recovery as the sector’s most urgent maturity gap because, in healthcare, technology downtime can ultimately become a patient-care issue.

The practical question coming out of the Nashville discussion was therefore not simply:

Do we have a recovery plan?

It was closer to:

What can the organization safely continue doing, for how long, and have we actually practiced operating that way?

That is a much more meaningful definition of resilience.

Third-Party Risk Is Becoming Dependency Management

Third-party risk was another recurring topic, but the conversation was clearly beyond the question of whether traditional questionnaires are sufficient.

The harder questions were about dependency.

Who are the critical suppliers behind your critical suppliers? Where are the concentration points? What happens when a SaaS, cloud or healthcare technology provider becomes unavailable? And what leverage does an organization actually have once the contract has been signed?

The Summit survey describes this evolution as moving “Beyond Questionnaires to Active Supply Chain Defense.” That includes fourth-party visibility, concentration-risk analysis, stronger contractual requirements and coordinated incident response.

The Nashville discussion reflected that same shift.

The benchmarking report provides additional context: 64% of CISOs place supply-chain/third-party risk among their top three risks, while 65% cite third-party and supply-chain blind spots as something keeping them up at night.

Yet only 8% outsource TPRM, meaning most healthcare organizations are still trying to manage an increasingly interconnected ecosystem largely with their own internal teams.

The challenge, therefore, is not simply to assess vendors. It is to understand the operational dependencies those vendors create—and what happens when one of those dependencies fails.

Security Has to Make the Business Easier to Run

Perhaps the most important theme connecting all three discussions was the idea that healthcare security cannot continue solving problems simply by adding friction.

Several comments came back to essentially the same question:

“How do I make people productive?”

That applies to AI adoption, identity, access controls, third parties and clinical workflows.

The security leader’s role increasingly involves creating a safe operating model in which the business can move quickly—not simply creating controls that prevent it from moving.

That becomes even more important when resources are limited.

The benchmarking report shows that 40% of health-sector security programs operate with 10 or fewer FTEs, while half of CISOs identify budget constraints—not talent availability—as their biggest workforce challenge.

The answer cannot simply be adding more people to manually administer more controls.

Automation, architecture, integration and better operating models will increasingly have to do more of the work.

A Few Lines Worth Carrying Forward

Several comments captured the Nashville conversation particularly well:

“AI is getting my goat.”

“When we have more Active Directory roles than we have people… something is wrong.”

“Why is healthcare eight years behind financial services?”

And perhaps the most important sentiment was less technical:

“This is about patients.”

That statement brought the entire conversation back to Health-ISAC’s core mission.

Identity, AI governance, resilience and third-party risk are cybersecurity problems. But in healthcare, the consequences extend well beyond technology.

They can affect continuity of care, clinical operations and patient safety.

The Bigger Takeaway

The Nashville discussion suggested a healthcare sector at an interesting point of transition.

Healthcare CISOs are being asked to finish yesterday’s modernization work while governing tomorrow’s technology.

They are cleaning up decades of identity complexity while preparing for autonomous agents. They are improving traditional disaster recovery while contemplating multi-week clinical outages. And they are moving away from static vendor assessments toward a model based on interconnected operational dependencies.

That makes the value of the Health-ISAC community particularly apparent.

Participants repeatedly wanted to know some version of the same questions:

• What are my peers actually doing?
• What is working?
• What tools and approaches are they using?
• How mature should we reasonably expect to be?

A benchmark can help answer some of those questions, but it cannot provide the full picture. The combination of benchmarking data, the forthcoming CISO Summit discussions and small peer forums such as Nashville creates something more valuable: an opportunity for security leaders to compare real-world experiences and turn individual challenges into shared practices.

And that may ultimately be the story of the Nashville evening.

It wasn’t that the group produced definitive answers to IAM, resilience or TPRM.

It was that participants recognized how remarkably similar their challenges are—and were willing to openly compare notes about what they are actually doing about them.

For a sector facing both rapidly accelerating technology and persistent foundational challenges, that kind of peer-to-peer conversation may be one of the most practical tools available.