Cross-sector insights: Adapting hospital incident response strategies to cyber security

The Cyber security sector often grapples with a lack of practical, hands-on testing and guidance, especially when compared to the health sector. In healthcare, methodologies such as PROMPT (Practical Obstetric Multi-Professional Training) and ISBAR (Introduction, Situation, Background, Assessment, Recommendation) provide structured, scenario-based training that is deeply embedded in practice. These methodologies are designed to simulate real-life situations, offering tangible benefits by enhancing team communication, decision-making, and resilience under pressure. They are conducted in environments that closely mimic actual clinical settings, ensuring that participants are well-prepared for real-world challenges. Cyber needs to transform how it plans, tests and trains incident response to evolve into a more efficient and effective emergency management function just like Health.

In contrast, the Cyber security sector frequently relies on tabletop exercises for incident response training. While these exercises are valuable for discussing plans and processes, they often fall short in testing a team's resilience and ability to perform under stress. Conducted in calm, office environments, these discussions lack the urgency and unpredictability of a real cyber incident. As a result, they may not adequately prepare teams for the high-pressure, rapidly evolving nature of actual cyber threats.

Moreover, the guidance provided in the Cybersecurity sector tends to be more theoretical and less actionable than in healthcare. While healthcare training is often grounded in evidence-based practices and real-world scenarios, cyber security guidance can be more abstract, focusing on frameworks and policies rather than practical application. For example, Cyber Incident Response Plans are lengthy and impractical compared to checklists and visuals which Health utilises. This can lead to a gap between understanding theoretical concepts and effectively implementing them during an incident.

To bridge these gaps, the Cyber security sector could benefit from adopting more immersive, scenario-based training approaches similar to those in healthcare. By creating realistic simulations that test teams' abilities to respond to cyber incidents under pressure, organisations can enhance their preparedness and resilience.

During our presentation, Ursula being an experienced health professional will delve into the tangible benefits of health frameworks and strategies, exploring how their structured, scenario-based approaches can be applied to cybersecurity. By drawing parallels between the two sectors, we hope to inspire a shift towards more immersive and practical training methods within Cyber, ultimately improving incident response and resilience.

We will share experiences in implementing these strategies within VMIA's cyber team. By integrating elements of healthcare's hands-on training methodologies, we have seen significant improvements in our team's preparedness and ability to respond effectively to cyber incidents. The beneficial outcomes have included enhanced communication, quicker decision-making, and a stronger overall team dynamic.

Our presentation will not only highlight the potential for cross-industry learning but also provide actionable steps for cyber security professionals to incorporate these strategies into their own practices. We look forward to engaging with attendees and fostering a dialogue on how we can collectively strengthen the Cyber security sector through innovative and practical approaches inspired by healthcare.