Managing Cyber Risks: How to Identify Digital Crown Jewel in a Healthcare Environment with PHI Everywhere

Eric Dull, Cyber Risk Services, and Josh Fournier, Specialist Master, Deloitte Consulting, LLP. “Crown Jewel identification” is the process of identifying critical applications that would materially impact patient care or business operations if compromised. This process has traditionally been subjective (relying heavily on interviews) and extremely broadly scoped since PHI is everywhere. Eric and Josh discuss an analytics-based approach in order to identify important assets that really matter from a security perspective, i.e., how to identify a true representation of what the organization must protect in order to make informed risk-based decisions. This analytic approach gives risk practitioners the insight required for a truly data-driven risk management program.