Essential Goals

To help healthcare organizations address common vulnerabilities by setting a floor of safeguards that will better protect them from cyber attacks, improve response when events occur, and minimize residual risk.

To aid in further understanding the alignment to HICP we have included the links to the HICP sub-practices page for each CPG.

Mitigate Known Vulnerabilities

Reduce the likelihood of threat actors exploiting known vulnerabilities to breach organizational networks that are directly accessible from the Internet.

HICP Practices:

Vulnerability Management
Endpoint Protection

HICP Sub-Practices:

Host/Server-Based Scanning ( 7.M.A )
Web Application Scanning ( 7.M.B )
Basic Endpoint Protection ( 2.M.A )

NIST Controls

CA-2, CA-5, CA-7, CA-8, PM-4, PM-15, RA-3, RA-5, SA-5, SA-11, SI-2, SI-4, SI-5, RA-1, RA-3, RA-5, SI-2, CA-5, PM-4, PM-9, PM-28, RA-7, CA-1, CA-2, RA-1, PM-4, PM-15, RA-7, SI-5, SR-6 AC-1, AC-17, AC-19, AC-20, SC-15

CISA CPG IDs

Mitigating Known Vulnerabilities (1.E)
No Exploitable Services on the Internet (2.W)

Additional Resources:

Email Security

Reduce risk from common email-based threats, such as email spoofing, phishing, and fraud.

HICP Practices:

Email Protection Systems

HICP Sub-Practices:

Email System Controls ( 1.M.A )
Workforce Education ( 1.M.D )
MFA for Email Access ( 1.M.B )

NIST Controls

MP-2, MP-3, MP-4, MP-5, MP-6, MP-7, MP-8, SC-28, SC-8, SC-11, AC-4, AC-5, AC-6, AU-13, PE-19, PS-6, SC-7, SI-4, AC-12, AC-17, AC-18, CP-8, SC-5, SC-7, SC-10, SC-11, SC-20, SC-21, SC-22, SC-23, SC-31, SC-37, SC-38, SC-47, AC-14, IA-1, IA-2, IA-3, IA-5, IA-8, IA-9, IA-10, IA-11

CISA CPG IDs

Email Security (2.M)

Additional Resources:

CISA Insights: Enhance Email & Web Security

Multifactor Authentication

Add a critical, additional layer of security, where safe and technically capable, to protect assets and accounts directly accessible from the Internet.

HICP Practices:

Identity & Access Management

HICP Sub-Practices:

Identity ( 3.M.A )
Authentication ( 3.M.C )
Multi-factor Authentication for Remote Access ( 3.M.D )

NIST Controls

AC-14, IA-1, IA-2, IA-3, IA-5, IA-8, IA-9, IA-10, IA-11, IA-1, IA-2, IA-3, IA-4, IA-5, IA-7, IA-8, IA-9, IA-10, IA-11, IA-12

CISA CPG IDs

Phishing-Resistant Multifactor Authentication (MFA) – 2.H

Additional Resources:

CISA's More Than A Password

Basic Cybersecurity Training

Ensure organizational users learn and perform more secure behaviors.

HICP Practices:

Email Protection Systems
Cybersecurity Oversight & Governance

HICP Sub-Practices:

Workforce Education ( 1.M.D )
Security Awareness & Training ( 10.M.C )

NIST Controls

AT-2, PM-13, PM-14, AT-3, PM-13

CISA CPG IDs

Basic Cybersecurity Training (2.I)

Additional Resources:

405(d) Knowledge on Demand

Strong Encryption

Deploy encryption to maintain confidentiality of sensitive data and integrity of Information Technology (IT) and Operational Technology (OT) traffic in motion.

HICP Practices:

Email Protection Systems
Endpoint Protection Systems
Data Protection & Loss Prevention

HICP Sub-Practices:

Email Encryption ( 1.M.C )
Basic Endpoint Protection Controls ( 2.M.A )
Data Security ( 4.M.C )

NIST Controls

SC-8, SC-11

CISA CPG IDs

Strong and Agile Encryption (2.K)

Revoke Credentials for Departing Workforce Members, Including Employees, Contractors, Affiliates, and Volunteers

Prevent unauthorized access to organizational accounts or resources by former workforce members, including employees, contractors, affiliates, and volunteers by removing access promptly.

HICP Practices:

Identity & Access Management

HICP Sub-Practices:

Provisioning, Transfers and Deprovisioning Procedures ( 3.M.B )
Authentication ( 3.M.C )

NIST Controls

IA-1, IA-2, IA-3, IA-4, IA-5, IA-7, IA-8, IA-9, IA-10, IA-11, IA-12, PS-1, PS-2, PS-3, PS-4, PS-5, PS-6, PS-7, PS-8, PS-9, SA-21

CISA CPG IDs

Revoking Credentials for Departing Employees (2.D)

Basic Incident Planning and Preparedness

Ensure safe and effective organizational responses to, restoration of, and recovery from significant cybersecurity incidents.

HICP Practices:

Cybersecurity Oversight & Governance

HICP Sub-Practices:

Incident Response ( 8.M.B )
Policies ( 10.M.A )
Backup Strategies ( 4.M.D )

NIST Controls

CP-10, IR-4, IR-8, CP-2, CP-3, IR-3, IR-8, CP-2, IR-4, IR-8, SI-5, PM-15

CISA CPG IDs

Incident Planning and Preparedness (5.A)

Additional Resources:

CISA Tabletop Exercise Packages

Unique Credentials

Use unique credentials inside organizations’ networks to detect anomalous activity and prevent attackers from moving laterally across the organization, particularly between IT and OT networks.

HICP Practices:

Identity and Access Management

HICP Sub-Practices:

Identity ( 3.M.A )
Provisioning, Transfers, and Deprovisioning Procedures ( 3.M.B )
Authentication ( 3.M.C )
Multi-Factor Authentication ( 3.M.D )

NIST Controls

IA-1, IA-2, IA-3, IA-4, IA-5, IA-7, IA-8, IA-9, IA-10, IA-11, IA-12

CISA CPG IDs

Unique Credentials (2.C)

Separate User and Privileged Accounts

Establish secondary accounts to prevent threat actor’s from accessing privileged or administrative accounts when common user accounts are compromised.

HICP Practices:

Identity & Access Management

HICP Sub-Practices:

Identity ( 3.M.A )
Provisioning, Transfers, and Deprovisioning Procedures ( 3.M.B )
Authentication ( 3.M.C )
Multi-Factor Authentication ( 3.M.D )

NIST Controls

AC-1, AC-2, AC-3, AC-5, AC-6, AC-14, AC-16, AC-24

CISA CPG IDs

Separating User and Privileged Accounts (2.E)

Vendor/Supplier Cybersecurity Requirements

Identify, assess, and mitigate risks associated with third party products and services.

HICP Practices:

Cybersecurity Oversight & Governance

HICP Sub-Practices:

Cybersecurity Risk Assessment & Management ( 10.M.B )

NIST Controls

SA-4, SA-9, SR-2, SR-3, SR-5

CISA CPG IDs

Vendor / Supplier Cybersecurity Requirements (1.I)

Enhanced Goals

To help healthcare organizations mature their cybersecurity capabilities and reach the next level of defense needed to protect against additional attack vectors.

To aid in further understanding the alignment to HICP we have included the links to the HICP sub-practices page for each CPG.

Asset Inventory

Identify known, unknown (shadow), and unmanaged assets to more rapidly detect and respond to new vulnerabilities.

HICP Practices:

IT Asset Management

HICP Sub-Practices:

Inventory of Endpoints and Servers ( 5.M.A )
Procurement ( 5.M.B )
Secure Storage for Inactive Devices ( 5.M.C )
System Placement and Data Classification ( 7.M.C )

NIST Controls

CM-8, PM-5, CM-8, AC-20, PM-5, SA-9, AU-12, CA-7, CM-3, SC-5, SC-7, SI-4

CISA CPG IDs

Asset Inventory (1.A)

Third Party Vulnerability Disclosure

Establish processes to promptly discover and respond to known threats and vulnerabilities in assets provided by vendors and service providers.

HICP Practices:

Cybersecurity Oversight and Governance

HICP Sub-Practices:

Cybersecurity Risk Assessment and Management ( 10.M.B )

NIST Controls

PM-30, SA-9, SR-1, SR-2, SR-3, SR-5, PM-9, RA-3, SA-15, SR-2, SR-3, SR-5, SR-6

CISA CPG IDs

Supply Chain Vulnerability Disclosure (1.H)

Third Party Incident Reporting

Establish processes to promptly discover and respond to known security incidents or breaches across vendors and service providers.

HICP Practices:

Cybersecurity Oversight and Governance
Vulnerability Management
Security Operations Center and Incident Response

HICP Sub-Practices:

Cybersecurity Risk Assessment and Management ( 10.M.B )
Patch Management, Configuration Management ( 7.M.D )
Information Sharing and ISACs/ISAOs ( 8.M.C )

NIST Controls

SA-4, SA-9, SR-2, SR-3, SR-5, PM-9, RA-3, SA-15, SR-2, SR-3, SR-5, SR-6

CISA CPG IDs

Supply Chain Incident Reporting (1.G)

Cybersecurity Testing

Establish processes to promptly discover and responsibly share vulnerabilities in assets discovered through penetration testing and attack simulations

HICP Practices:

Vulnerability Management
Security Operations Center and Incident Response

HICP Sub-Practices:

Penetration Testing ( 7.L.A )
Attack Simulation ( 7.L.C )
Information Sharing and ISACs/ISAOs ( 8.M.C )

NIST Controls

CA-2, CA-7, PM-16, PM-28, RA-2, RA-3

CISA CPG IDs

Vulnerability Disclosure / Reporting (4.B)

Cybersecurity Mitigation

Establish processes internally to act quickly on prioritized vulnerabilities discovered through penetration testing and attack simulations.

HICP Practices:

Security Operations Center and Incident Response

HICP Sub-Practices:

Information Sharing and ISACs/ISAOs ( 8.M.C )
Patch Management ( 7.M.D )
Vulnerability Remediation Planning ( 7.L.B )

NIST Controls

CA-2, CA-7, PM-16, PM-28, RA-2, RA-3

CISA CPG IDs

Third Party Validation of Cybersecurity Control Effectiveness (1.F)

Detect and Respond to Relevant Threats and Tactics, Techniques, and Procedures

Ensure organizational awareness of and ability to detect relevant threats and TTPs at endpoints. Ensure organizations are able to secure entry and exit points to its network with endpoint protection.

HICP Practices:

Endpoint Protection Systems

HICP Sub-Practices:

Endpoint Detection and Response ( 2.L.C )

NIST Controls

PM-15, PM-16, RA-10, SI-5, PM-12, PM-16, RA-3, RA-10, SI-5, AU-12, CA-7, CM-3, SC-5, SC-7, SI-4

CISA CPG IDs

Detecting Relevant Threats and TTPs (3.A)

Network Segmentation

Mission critical assets are separated into discrete network segments to minimize lateral movement by threat actors after initial compromise.

HICP Practices:

Network Management

HICP Sub-Practices:

Network Segmentation ( 6.M.B )

NIST Controls

AC-4, AC-10, SC-7, SC-10, SC-20, AC-12, AC-17, AC-18, CP-8, SC-5, SC-7, SC-10, SC-11, SC-20, SC-21, SC-22, SC-23, SC-31, SC-37, SC-38, SC-47

CISA CPG IDs

Network Segmentation (2.F)

Centralized Log Collection

Collection of necessary telemetry from security log data sources within an organization’s network that maximizes visibility, cost effectiveness, and faster response to incidents.

HICP Practices:

Security Operations Center and Incident Response

HICP Sub-Practices:

Security Operations Center ( 8.M.A )
Incident Response ( 8.M.B )

NIST Controls

AU-1, AU-2, AU-3, AU-6, AU-7, AU-12, AU-13, AU-14, AU-16

CISA CPG IDs

Log Collection (2.T)

Centralized Incident Planning and Preparedness

Ensure organizations consistently maintain, drill, and update cybersecurity incident response plans for relevant threat scenarios.

HICP Practices:

Security Operations Center and Incident Response

HICP Sub-Practices:

Security Operations Center ( 8.M.A )
Incident Response ( 8.M.B )

NIST Controls

CM-3, CM-4, SA-10

CISA CPG IDs

Incident Response (IR) Plans (2.S)

Configuration Management

Define secure device and system settings in a consistent manner and maintain them according to established baselines.

HICP Practices:

Vulnerability Management

HICP Sub-Practices:

Patch Management, Configuration Management ( 7.M.D )

NIST Controls

CM-1, CM-2, CM-3, CM-4, CM-5, CM-6, CM-7, CM-9, SA-10

CISA CPG IDs

Document Device Configurations (2.O)

HPH Cybersecurity Performance Goals

Purpose

Essential Goals

Mitigate Known Vulnerabilities

HICP Practices:

HICP Sub-Practices:

NIST Controls

CISA CPG IDs

Additional Resources:

Email Security

HICP Practices:

HICP Sub-Practices:

NIST Controls

CISA CPG IDs

Additional Resources:

Multifactor Authentication

HICP Practices:

HICP Sub-Practices:

NIST Controls

CISA CPG IDs

Additional Resources:

Basic Cybersecurity Training

HICP Practices:

HICP Sub-Practices:

NIST Controls

CISA CPG IDs

Additional Resources:

Strong Encryption

HICP Practices:

HICP Sub-Practices:

NIST Controls

CISA CPG IDs

Revoke Credentials for Departing Workforce Members, Including Employees, Contractors, Affiliates, and Volunteers

HICP Practices:

HICP Sub-Practices:

NIST Controls

CISA CPG IDs

Basic Incident Planning and Preparedness

HICP Practices:

HICP Sub-Practices:

NIST Controls

CISA CPG IDs

Additional Resources:

Unique Credentials

HICP Practices:

HICP Sub-Practices:

NIST Controls

CISA CPG IDs

Separate User and Privileged Accounts

HICP Practices:

HICP Sub-Practices:

NIST Controls

CISA CPG IDs

Vendor/Supplier Cybersecurity Requirements

HICP Practices:

HICP Sub-Practices:

NIST Controls

CISA CPG IDs

Enhanced Goals

Asset Inventory

HICP Practices:

HICP Sub-Practices:

NIST Controls

CISA CPG IDs

Third Party Vulnerability Disclosure

HICP Practices:

HICP Sub-Practices:

NIST Controls

CISA CPG IDs

Third Party Incident Reporting

HICP Practices:

HICP Sub-Practices:

NIST Controls

CISA CPG IDs

Cybersecurity Testing

HICP Practices:

HICP Sub-Practices:

NIST Controls

CISA CPG IDs

Cybersecurity Mitigation