Executive Leadership Programs
Cyber Insurance Renewal & Readiness Assessment
Cyber insurance policies are quickly becoming more difficult to obtain, rates are higher, and premiums are inadequate for the risks assumed. First Health knows what carriers are asking for and what you need to do to prepare for policy renewal. Our policy experts work with your team to position your organization for the best outcomes and coverage based on your requirements.
- Provides expert CISOs and security leaders with many years of experience with Cyber renewals
- Experience with responding to cybersecurity questions from carriers
- Provides advice and guidance on must-have security capabilities to be insured
- Experts that keep up to date on the latest changes in the cyber insurance market and requirements
- Assists the organization develop a roadmap and alignment to ensure success with future renewals and applications for insurance
Executive Leadership Programs
Virtual & Fractional CISO Program
Not all healthcare organizations need a full-time CISO, and many organizations run into situations where temporary or short-term, CISO resources are needed to help drive strategies and risk reduction programs. First Health is fortunate to have on staff some of the best minds and thought leaders in the healthcare security industry who are passionate about healthcare business and securing healthcare against the constant security threats. Our vCISO & Fractional CISO programs enable your organization to select the appropriate amount of consulting needed to meet your budgetary constraints while keeping the security program moving in the right direction.
- Provides CISO services right sized and within budgetary requirements
- Assists with governance and planning with leadership
- Aligns the business with cybersecurity and business objectives
- Provides strategic guidance and support at all leadership levels
- Advises the organization on risk management and reduction strategies
- Addresses many challenges including talent, retention, and costs of hiring top talent
Executive Leadership Programs
CISO Strategy & Support
Provides support to busy CISOs and compliments with specialized strategy, knowledge, and industry expertise from seasoned healthcare CISO resources with many years of real-world experience across many different types of healthcare organizations. First Health’s CISO Strategy & Support program offers benefits to existing CISOs and leadership team members by augmenting their resources to help drive key strategies, decisions, roadmaps, and planning activities.
- Provides a trusted advisor for CISOs and CIOs
- Assists in reviewing and building strategies and roadmaps to meet cybersecurity and business objectives
- Leadership and experience in collaborating and building consensus
- Driven and measured by the business intelligence of cybersecurity data and metrics
Strategic Programs
Enterprise IT Security Risk Assessment
Healthcare is constantly under the threat of a security attack from all directions and can no longer rely on a single point-in-time snapshot measurement of security risks to their organization’s digital assets. As a result of the constantly changing security threat landscape, each organization must enable a continuous security program actively identifying and reducing security risks in their always expanding network-connected asset realm.
First Health’s continuous Enterprise IT Security Risk Assessment and Engineering program services efficiently, effectively, and continuously identify security risks to your healthcare organization while working with the organization’s IT department to plan, prioritize, and implement risk-reducing solutions resulting in a constant cycle of securing your network connected digital assets.
Strategic Programs
405(d) & NIST Cybersecurity Framework (CSF)
Assess healthcare organization’s ability to accelerate a prescriptive and targeted approach to the five biggest risks in healthcare, the 10 leading practices, and the 23 control surfaces that maximize your investments in security capability and maturity. First Health advisors are experts on HICP 405(d) practices and benefits.
- The BIG 5: Accelerate cyber threat action and capability targeting:
- Ransomware
- Loss or Theft of Equipment or Data
- Insider, Accidental, or Intentional Data Loss
- Attacks Against Medical Devices
- Social Engineering
- Top 10 Security Risks Reduction Program:
- Email and Endpoint Protection Systems
- Access Management and IT Asset Management
- Data Protection and Loss Prevention
- Network and Vulnerability Management
- Incident Response
- Medical Device Security
- Cyber Policies
- Map findings and requirements to the controls that result in the biggest risk impact
Strategic Programs
Data Privacy & Visibility Program
The privacy of healthcare patient, employee, and corporate data is a pivotal component of the overall security program. First Health’s data privacy program maximizes data visibility enabling healthcare organizations to report on the data’s who, what, where, when, and how for each data transaction.
- Modern data visibility tool through the First Health partnership program
- Provides the highest level of visibility into your organization’s data transactions
- Efficient and effective solution resulting in fewer resource hour requirements
Strategic Programs
M&A Target Entity Assessment
Provides specialized knowledge and processes that are irregularly or infrequently needed and therefore not maintained in-house. The assessment identifies the target’s current security posture enabling the purchasing organization to identify security risks and plan remediations post-purchase.
- Assess the risk of M&A target using enterprise risk assessment methodology and frameworks
- Provides HIPAA, NIST, CMMC, and other framework alignment reports
- Detailed guidance and risk stratification to assist the organization in making risk decisions during acquisition
- Details the key administrative, physical, and technical control gaps
- Provides prioritization and risk guidance for a detailed post-acquisition risk mitigation plan
Strategic Programs
3rd Party Risk Management
Helps healthcare organizations manage vendor security risks by providing a tool to be aware of and manage vendor security risk assessments for the companies that healthcare organizations buy products and services from.
- Assess: Review current 3rd party (vendor/supply chain) risk process, develop recommendations, and craft a plan for program capability and maturity
- Identify and prioritize critical vendors based on enterprise impact
- Assess risk to enterprise related to 3rd party interaction or relationship
- Risk education to key stakeholders
- Continuous monitoring capability
- Explore efficiency in assessment and automation
- Program support requirements: Determine ongoing technology, personnel, and policy requirements
- Scalable managed services enablement based on key findings and requirements
Strategic Programs
Ransomware Prevention & Recovery Assessment
Addresses a prevalent and highly publicized type of security incident. Identifies the most critical gaps/risks and mitigation recommendations
- Assess the environment against key risk factors for ransomware prevention, detection, and recovery
- Ensure the organization has fully immutable backup solutions working and tested
- Align organization and risk plan to focus on the biggest threat vectors and ability to recover quickly
- Ensure the organization has incident response plans and ransomware playbooks implemented
- Complete analysis and recommendations for remediation
Strategic Programs
Disaster Recovery Assessment
Addresses a universal need to understand security posture and readiness to recover from a disaster. Service includes an assessment of and a roadmap of recommendations for staff, systems, and structure to accomplish desired recovery objectives.
- Provides analysis of current infrastructure recovery posture
- Analysis of current recovery objectives and necessary capabilities to meet those objectives
- Complete recommendations on investments and infrastructure changes to meet organizations objectives and requirements
- Development of disaster recovery plans and playbooks
- Experience aligning disaster recovery capabilities with major EMR vendor requirements
- Assistance in planning and coordinating testing activities
Platform and Engineering Services
Cloud Migration Strategy and Security
Address a broad market need in understanding how to manage cloud security in Microsoft Azure and AWS environments. Identifies current risks and provides a roadmap to a standard model and framework.
- Review regulatory requirements from a technical perspective and a healthcare standard perspective (NIST, CSA)
- Understand best practices for CSPs as they support your digital health environment
- Assess your cloud security program and current state deployments across the enterprise
- Refine roles and responsibilities for cloud security to build a program roadmap
- Assess 3rd party vendor cloud platform security risk
Platform and Engineering Services
MS 365 Platform & Security Assessment & Services
Addresses a need for specialized security & leading practices knowledge for MS365. Identifies gaps in security, configuration, practices, operations, and provides remediation and roadmap services against CIS benchmarks for better business risk decisions related to the platform.
- Review best practices configuration and design security plan
- Audit existing tenants against CIS and other best practices
- Provides recommendations for alignment with other frameworks
- Guidance to leadership on the impact of decisions and residual risk factors
- Consulting and engineering assistance to execute the plan
Platform and Engineering Services
AWS Platform & Security Assessment & Services
Addresses a need for specialized security & leading practices knowledge for AWS. Identifies gaps in security, configuration, practices, operations, and provides remediation and roadmap services against CIS benchmarks for better business risk decisions related to the platform.
- Assessment against best practices and CIS controls
- Recommendations for remediation of risks and control alignment
- Design of implementation and cloud security plan
- Consulting and engineering assistance to execute security plan
Platform and Engineering Services
Advanced Threat Protection Platforms & Services
Full range of services for CrowdStrike – Standard, Premium, Complete
Only staff augmentation for other applications
- The collaborative implementation model ensures successful results aligned with the CrowdStrike operating model
- Leading healthcare industry knowledge and experienced engineering and program management staff assigned to each engagement
- Deploy and configure using industry-leading standards and practices
Platform and Engineering Services
Vulnerability Management Program
First Health’s unique vulnerability management program is a comprehensive connected and digital asset security vulnerability, patching, and penetration testing, and risk reduction program. Our approach includes identification and remediation, or mitigation planning, to address and reduce security risk for all your network-connected assets such as Microsoft products, 3rd party applications, internal and external penetration testing, and reporting, OT and Medical Devices, and related security validation services resulting in one of the most comprehensive security exploit protection and prevention for your healthcare organization.
- A full range of services identifying vulnerabilities, deploying patches to address vulnerabilities, and follow-on penetration tests to validate security flaws are remediated against attacks
- Includes all relevant programs and professional services to ensure quality outcomes for each customer
Platform and Engineering Services
Cloud Managed NOC, SIEM, and SOC Program
The most mature security programs in the healthcare industry are adopting SIEM and SOC solutions. First Health’s approach to these services, platforms and solutions takes into consideration several variables and we provide what your organization needs to hear about these solutions versus what you might wish to hear in a transparent and honest approach which very well might be unique to the sales cycle in this industry. Each organization is unique in its journey to improve its security posture and that takes due diligence, prioritization, and structure to ensure a structure, budget-conscious approach leads to a successful implementation of a holistic security program with the right solutions in order of priority to establish defensive walls while confidently connecting the various puzzle pieces.
- 24×7 operations center providing availability, confidentiality, and integrity for your organization
- Cloud-based from step one resulting in the least burden on your already overutilized team members
- Data science approaches deliver the shortest time to value for your security use cases
