Project 2: Identifying Assets and Activities to Be Protected

Project 2: Identifying Assets and Activities to Be Protected Purpose In Project 1, you established the risk management context for Sabine Coastal Health Network (SCHN). In Project 2, you will build on that work by identifying what SCHN depends upon to accomplish its mission and what therefore requires protection. Before an organization can effectively analyze threats, vulnerabilities, or risk, it must understand: its important business activities, the assets supporting those activities, the relationships and dependencies among those assets, and which assets and activities deserve the greatest attention. Your work in this project will become the foundation for Project 3. Assigned Readings Project 2 is supported by the following course readings: Chapter 1 – Risk Management Fundamentals Provides the foundation for connecting risk management decisions to organizational mission and priorities. Chapter 2 – Managing Risk: Threats, Vulnerabilities, and Exploits Provides background for understanding why assets must be identified before analyzing what could affect them. Chapter 6 – Performing a Risk Assessment Places asset identification within the larger risk assessment process. Chapter 7 – Identifying Assets and Activities to Be Protected The primary chapter for this project. Focuses on identifying important information, systems, people, facilities, technology, and organizational activities. NIST Risk Management Framework Use relevant concepts from the Prepare and Categorize activities where appropriate. SCHN Scenario Continue using the complete Sabine Coastal Health Network (SCHN) scenario from Project 1. SCHN is a regional healthcare organization with approximately: 475 employees, five facilities, and 70,000 patients. The organization relies on electronic health records, cloud services, local systems, medical technology, networks, third-party vendors, healthcare personnel, and physical facilities. SCHN handles protected health information, payment information, employee information, and financial information. It operates with limited cybersecurity and financial resources and must account for hazards such as hurricanes, flooding, power outages, fire, and industrial disruption. Project 2 Scenario Change Since Project 1, SCHN management has approved a telehealth and remote patient monitoring program. The program will: use a third-party cloud-based telehealth platform, integrate selected information with the SCHN electronic health record, allow authorized providers to connect from SCHN facilities and approved remote locations, allow patients to participate through personal computers or mobile devices, use connected monitoring devices for selected patients, exchange patient information among SCHN, providers, patients, and the vendor, and rely largely on existing SCHN cybersecurity and IT personnel. Management wants the program implemented quickly and has not approved a major increase in cybersecurity staffing or funding. This change becomes part of the SCHN scenario. You do not need to rewrite Project 1. Instead, identify where the new information changes or expands your earlier assumptions, scope, stakeholders, dependencies, or priorities. Your Role You are continuing in your role as a cybersecurity analyst supporting SCHN's risk management effort. Think of yourself as the senior analyst. Generative AI may assist you as a junior analyst, but you remain responsible for evaluating information, identifying errors or unsupported assumptions, making decisions, and defending your reasoning. Project Requirements 1. Review Project 1 and the Scenario Change Briefly explain how the telehealth and remote monitoring program affects your Project 1 analysis. AI Prompt and Evaluation Log Include an AI Prompt and Evaluation Log based on your project. You must document at least three meaningful AI interactions that contributed to your work. The three interactions should demonstrate the development of your analysis rather than four slightly different versions of the same prompt. At least one interaction must demonstrate that you challenged, corrected, substantially revised, or rejected part of an AI response. Expectations for the Prompt Log A strong prompt log should show progression in your thinking. For example, an interaction might cause you to: · Change an assumption · Ask a more focused question · Investigate an issue further · Reject a recommendation · Reconsider the priority of a risk · Compare alternatives · Locate supporting evidence · Revise part of your analysis Simply asking AI to “write Project 1” and then documenting the response does not demonstrate appropriate use of AI for this assignment. Your evaluation of the AI response is more important than the sophistication of the prompt itself. *Attached below is the reading and project 1 and its Prompt log use this to help do the Project 2 and prompt log* Address any important changes involving: assumptions, scope or boundaries, stakeholders, external dependencies, or organizational priorities. If you revise an earlier assumption, explain what changed and why. 2. Identify Important Business Activities Identify the major activities SCHN must perform to accomplish its mission. Examples may include: patient care, clinical operations, patient records, scheduling, billing and payments, healthcare administration, telehealth, remote patient monitoring, and IT support. For each major activity, briefly explain: what it accomplishes, why it matters to SCHN, and whether it depends mainly on manual processes, automated systems, or both. Focus on the most important activities rather than attempting to document everything SCHN does. 3. Identify Important Assets Develop an inventory of significant assets supporting SCHN operations. Include appropriate assets from categories such as: data and information, hardware and medical technology, software and information systems, personnel, facilities, network and communication resources, and cloud and third-party services. A table is recommended. Asset or Asset Group Category Business Purpose Primary Users/Owners Important Dependencies Identify meaningful asset groups rather than every individual workstation, employee, server, or device. 4. Connect Activities to Assets Select several important SCHN business activities and show the assets they depend upon. Consider relationships involving: people, information, software, hardware, networks, facilities, authentication or access services, and external vendors. Create a simple activity-to-asset dependency table or diagram. Give particular attention to new dependencies created by the telehealth and remote monitoring program. 5. Prioritize the Most Important Assets and Activities Identify the five assets, asset groups, or business activities that deserve the greatest attention as SCHN continues its risk assessment. For each selection: identify the asset or activity, explain why it deserves high priority, and explain the organizational consequences if SCHN could no longer properly use, access, trust, or depend upon it. Consider factors such as: patient care and safety, confidentiality, integrity, availability, business operations, financial consequences, legal or regulatory responsibilities, organizational reputation, and dependence of other activities on the asset. There is no single correct list. Your reasoning is more important than matching a predetermined answer. 6. Management Brief Conclude with a short Management Brief explaining: what SCHN most needs to protect, which activities have major technology or external dependencies, how the telehealth expansion changed SCHN's protection needs, and what management should understand before moving into the next phase of the risk assessment. Write for a management audience and focus on organizational consequences rather than unnecessary technical detail. Required Submission Sections Your submission should include: Introduction Project 1 Review and Scenario Change Important Business Activities SCHN Asset Inventory Activity-to-Asset Dependencies Five Priority Assets and Activities Management Brief References Appendix: AI Prompt and Evaluation Log What Not to Include Project 2 focuses on what SCHN needs to protect and why. Do not perform detailed work that belongs in later projects, including: threat analysis, vulnerability or exploit analysis, formal risk scoring, likelihood calculations, security control recommendations, mitigation planning, Business Impact Analysis, recovery objectives, Business Continuity Planning, Disaster Recovery Planning, or incident response planning. Project 2 asks: What matters to SCHN, and what does the organization depend upon? Later projects will address what could happen to those assets, how serious the risk is, and what SCHN should do about it. Use of Generative AI You are required to use an approved generative AI tool during the project. Appropriate uses include: identifying asset categories you may have overlooked, identifying dependencies, examining the effects of the scenario change, challenging your prioritization, reviewing your reasoning, or critiquing your Management Brief. Do not submit an AI-generated report without evaluating and revising the output. AI Prompt and Evaluation Log (Turn in separately) Complete the standard AI Prompt and Evaluation Log used for all course projects. Document at least three meaningful AI interactions, including at least one interaction in which you challenge, correct, substantially revise, or reject part of an AI response. For each interaction include: Purpose Complete Prompt Response Summary Evaluation Decision Effect on the Project The log should be included as an appendix and is graded separately. (Turn in separately) Sources and Evidence Use the assigned course readings as the primary basis for your analysis. You may also use the assigned NIST RMF material and appropriate supporting sources. Use APA 7th edition citations and references. The SCHN scenario does not require a citation. If information is unavailable, make a reasonable assumption and clearly identify it as an assumption. Do not invent unsupported technical details about SCHN. Recommended Length Approximately 4-5 pages of project content, excluding: title page, tables, references, and the AI Prompt and Evaluation Log. Tables do not count toward the page limit. The goal is not to fill the maximum number of pages. The goal is to provide concise, focused analysis showing that you understand what SCHN depends upon, why those resources matter, and how the scenario change affects the organization. Project Grading The project analysis is worth 40 points. The AI Prompt and Evaluation Log is graded separately using the standard 20-point rubric. Total Project 2 value: 60 points. Connection to Project 3 Project 2 establishes the asset and activity baseline for Project 3. In Project 3, you will use the assets and activities identified here to examine: threats, vulnerabilities, and possible exploits. You may also receive additional SCHN scenario changes that require you to reconsider previous assumptions or conclusions. This is intentional. Risk management is an ongoing process, and analysts must revise earlier work when organizational conditions change.