Ten Questions Every General Manager Should Be Able to Answer

An executive checklist for protecting patient data, reducing cyber risk, and keeping healthcare operations running

By Mladen Petrovic | July 19, 2026

When a healthcare organization suffers a cyber incident, the business problem is not technology alone. It is whether patients can still receive care, leaders can still make decisions, and the organization can still operate with confidence. NIST CSF 2.0 frames cybersecurity as a risk management and communication issue for the whole organization, not just IT.

---

1. Do We Know Which Services Must Stay Running?

Every general manager should be able to name the clinical and administrative services the organization cannot afford to lose. That includes scheduling, billing, patient records, communication, and any system that affects care delivery. If leaders cannot define these priorities, they cannot set recovery expectations or allocate resources well.

---

2. Do We Know What Patient Data Matters Most?

Not all data creates the same level of risk. General managers should know which information would cause the most harm if exposed, altered, or unavailable, especially electronic protected health information under HIPAA. HIPAA’s Privacy and Security Rules require safeguards for privacy, confidentiality, integrity, and availability, which makes data classification a leadership issue, not an IT side task.

---

3. Have We Assigned Clear Accountability?

A strong security posture fails when ownership is vague. Leaders should know who approves risk decisions, who escalates incidents, and who has authority during a disruption. NIST CSF 2.0 emphasizes governance and enterprise risk communication across the organization, which makes accountability part of executive management.

---

4. Can We Keep Operating During a Cyber Incident?

General managers need a clear answer on how the organization functions if core systems go down. This means knowing the manual fallback process, the recovery sequence, and the time the organization can work safely without normal technology. HHS’s Health Industry Cybersecurity Practices focus on resilience and practical safeguards for healthcare operations, not just prevention.

---

5. Do We Test Our Recovery Plans in Real Conditions?

A plan on paper does not prove readiness. Executives should ask whether staff have practiced outage procedures, whether leadership has reviewed recent exercises, and whether lessons from drills have led to real changes. ENISA’s health threat reporting highlights the sector’s exposure to serious operational disruption, which makes realistic testing essential for continuity.

---

6. Do We Know Our Biggest Business Risks?

Cyber risk should sit inside enterprise risk management, not beside it. General managers should understand which threats could delay care, create legal exposure, interrupt revenue, or damage trust. NIST CSF 2.0 was designed to help organizations understand, assess, prioritize, and communicate cybersecurity risk in business terms.

---

7. Are Our Third Parties Safe Enough?

Healthcare organizations rely on vendors for claims, billing, software, storage, support, and data exchange. That means a weak partner can become your problem very quickly. Leaders should know how the organization reviews vendor risk, contract expectations, and response obligations, since NIST CSF 2.0 also stresses communication with suppliers and partners.

---

8. Do Staff Know What to Do First?

Most incidents become worse when employees hesitate or guess. General managers should ask whether staff know how to report suspicious activity, where to find emergency contacts, and what actions to take when systems fail. HHS guidance and HIPAA both support the idea that security depends on workforce awareness and operational discipline, not just policy documents.

---

9. Would a Breach Threaten Patient Trust?

Cybersecurity in healthcare affects reputation, patient loyalty, and community confidence. Leaders should understand the likely business and human impact of a breach, not just the compliance consequence. ISO/IEC 27001 treats information security as a management system, which reinforces the idea that trust and control both depend on consistent governance.

---

10. What Decision Will We Make Next Quarter?

The best executive question is not whether the organization passed an audit. It is whether leaders will fund, improve, and measure resilience before the next disruption arrives. General managers should leave every review with a short list of decisions, owners, and deadlines. That is what operational excellence looks like in healthcare: readiness, accountability, and continuity.