A hospital IRM lead wants threat-intelligence headlines to inform risk context without converting Risk into Security Incident Response. Which approach fits?
Select an answer to reveal the explanation.
Short Explanation
Threat intel is seasoning, not the whole meal. Drop a short context note on the related technology risk, keep treatment in the risk lifecycle, and leave SIR playbooks for actual security incidents.
Full Explanation
Threat-intelligence headlines can inform technology-risk context in a hospital IRM program when summaries are attached as light context on relevant risks while response workflows remain in the IRM risk lifecycle—not Security Incident Response case management. IRM should enrich residual discussion with external threat cues without converting Risk into a security operations product. Architecture that keeps assessment, appetite, and treatment in Risk, and keeps playbooks and incident cases in SIR, preserves both products’ purposes for civic clinical systems.
Replacing risk assessments with SIR playbook execution for every advisory fails because advisories are context, not automatically confirmed incidents requiring playbook runs. Moving all residual scoring into the security incident workspace exclusively abandons the risk register as the posture system of record. Requiring every KRI to open a security incident before the risk register can update couples monitoring to incident volume and floods SIR with non-incidents.
Exam caveat: CIS-RC often contrasts Risk context enrichment with SIR process ownership. Threat intel as context is in scope for Risk; wholesale relocation of residual scoring into SIR is not the intended architecture.
Operational check: pick a ransomware or EHR technology risk; attach a short threat-intel summary as context; confirm no automatic SIR case is required for register updates; verify KRI breaches create risk attention or issues per design, not mandatory SIR tickets for every advisory headline.