# A Systematization of Cybersecurity Regulations, Standards and Guidelines for the Healthcare Sector

**Authors:** Maria Patrizia Carello, Alberto Marchetti Spaccamela, Leonardo Querzoni, Marco Angelini  
**arXiv:** [2304.14955](https://arxiv.org/abs/2304.14955)  
**Date:** 2023-04-28  
**Summary page:** https://www.summarizepaper.com/en/paper/2304.14955v1/

## Key points

- The healthcare sector's adoption of IT solutions has led to an increase in cybersecurity incidents
- Organizations worldwide have implemented regulations, standards, and best practices for cybersecurity and data protection in healthcare
- Operators still struggle to defend against cyber attacks despite these measures
- The authors conducted a systematization of significant cybersecurity documents relevant to the healthcare sector
- 49 important documents were collected and analyzed to identify key excerpts related to technical security and governance measures
- Manual analysis by experts was conducted to identify relevant excerpts
- Approximately 2,800 key excerpts were identified across the 49 documents
- The NIST Cybersecurity Framework v1.1 was used to map the key excerpts, with an extension from the Italian Cybersecurity Framework for data security and privacy
- Most of the mapped excerpts fell under the Protection and Identify functions within the framework, with few addressing Respond, Detect, and Recover functions
- The paper successfully systematized cybersecurity regulations, standards, and best practices in the healthcare sector resulting in 2,800 security controls and nine findings.

## Summary

The healthcare sector's increasing adoption of IT solutions has led to a rise in cybersecurity incidents. To address this issue, organizations worldwide have implemented regulations, standards, and best practices for cybersecurity and data protection in healthcare. However, the application of these documents presents operational challenges, and operators still struggle to defend against cyber attacks. In this paper, the authors contribute a systematization of significant cybersecurity documents relevant to the healthcare sector. They collected 49 important documents and analyzed them to identify key excerpts related to technical security and governance measures. The identification process involved manual analysis by experts in security governance, cybersecurity, and data protection. The identified excerpts were then extracted from their original documents and compiled into a table for further analysis. Another group of information security specialists reviewed the collected excerpts to ensure their relevance. This step helps organize the texts and extract only the relevant contents related to security and data protection. The results of the document analysis showed that approximately 2,800 key excerpts were identified across the 49 documents. These excerpts were distributed among different categories as depicted in Figure 3. In the next step, these key excerpts were mapped using the NIST Cybersecurity Framework v1.1, which provides standard terminology for cybersecurity functionalities. Since some excerpts referred to data security and privacy, an extension of the framework was necessary. The Italian Cybersecurity Framework was leveraged as it includes categories and subcategories dedicated to data protection while being retro-compatible with the NIST framework. Each excerpt was carefully assessed for its semantic content and linked to one or more subcategories of the framework based on its function, category, and subcategory. The mapping process helped identify overlaps between different excerpts and resolve them accordingly. The results showed that most of the mapped excerpts fell under the Protection and Identify functions within the framework. Only a few addressed Respond, Detect, and Recover functions. In conclusion, this paper successfully systematized cybersecurity regulations, standards, and best practices in the healthcare sector. The analysis of 49 documents resulted in the identification of 2,800 security controls and nine findings.