You worked as a security officer in the highly-regulated, compliance-driven nuclear power industry. Now, you have joined a very progressive healthcare system whose management recognizes that not all...

You worked as a security officer in the highly-regulated, compliance-driven nuclear

power industry. Now, you have joined a very progressive healthcare system whose

management recognizes that not all risk is bad. The management team expects you

to manage information security risks judiciously, to mitigate it when possible, and

to prepare the organization to respond effectively and efficiently when necessary.

What steps will you take to transition from a compliance-driven security program

to a risk-based program that supports clinical and business objectives?