Data Breach Risk Management: Examining Impacts, Strategies, and Cultural Shifts

Abstract

Data breaches result in realized operational risks that threaten organizational health. Ollaw Health Systems (OHS), a pseudonym for a health system comprising two outpatient clinics and four hospitals, experienced multiple consecutive breaches that exposed Patient Health Information. The impacts left OHS struggling to mitigate the impact on employee morale, sustain operations during incidents, and maintain quality patient care. A narrative literature review was conducted to understand how organizations design enterprise risk management practices that foster a preventative, sustainable cybersecurity culture. The review suggests a bifocal approach, with leaders considering both short and long-term controls. The findings recommend that leaders consider short-term actions, such as managing reputational risk and providing personnel training, while focusing on long-term strategic activities, such as implementing risk registers to build a preventive culture and formalizing the ERM plan within the organization. KEYWORDS: data breach, cybersecurity, enterprise risk management, risk identification