Project 5

this is a continuation project so please use all previous projects/attached files to complete assignment In Project 5, you will use the results of your Project 4 risk assessment to develop a practical Risk Mitigation Plan for SCHN. Your job is to determine: • Which risks require action first. • Which risk treatment approach should be used. • Which safeguards or controls should be implemented. • What those controls are expected to accomplish. • What implementation constraints SCHN must consider. • What risk will remain after the proposed actions are completed. The goal is not to eliminate all risk. Your goal is to recommend a realistic combination of actions that reduces SCHN's most important risks to an acceptable level while considering the organization's resources, operations, patient care responsibilities, and regulatory obligations. Scenario Update SCHN executive leadership has reviewed the results of the organizational risk assessment. Leadership agrees that several risks require attention but has made one important limitation clear: SCHN can approve no more than three major new risk-reduction initiatives during the next 12 months. Smaller procedural, configuration, training, or policy improvements may also be recommended when reasonable, but SCHN does not have the financial or personnel resources to implement every possible security improvement immediately. The executive leadership team expects you to determine which actions deserve priority. This means you will need to make choices. Some risks may need to be: • Mitigated immediately. • Mitigated over time. • Transferred. • Avoided. • Accepted or temporarily accepted. You should not assume that every risk can or should receive a major new security investment. Your Role You are continuing in your role as a cybersecurity analyst supporting SCHN's cybersecurity and enterprise risk management program. Senior leadership has asked you to turn the previous risk assessment into an actionable mitigation plan. Your recommendations must reflect the realities of SCHN rather than describing what a large organization with unlimited money and personnel might do. Consider factors such as: • Patient safety. • Protection of sensitive information. • Regulatory compliance. • Limited financial resources. • Limited IT and cybersecurity personnel. • Healthcare operations. • Employee productivity. • Existing technology. • Legacy systems and medical devices. • Third-party dependencies. • Organizational growth. • Hurricanes, flooding, power outages, fire, and other regional hazards. • The need to maintain and recover essential healthcare services. Required Course Sources