Decision Packet · v1.0
Q2 2026 — Crown-Jewel Risk Disposition
Situation
Q2 program review covers the crown-jewel ePHI store and its supporting control envelope. 487 endpoints catalogued across three network segments; 12 unsanctioned SaaS surfaces detected by the shadow-IT scan. Continuous monitoring posture is operating; the residual question is risk acceptance for two compensating-control gaps surfaced this cycle.
Risk & Impact
14 critical findings scored against the revenue-at-risk model. Two compensating gaps (vendor-SOC-2 attestation lapse + patch-cycle #38 awaiting CAB sign-off) carry residual risk of $1.4M in unmitigated regulatory exposure if a HITRUST audit lands before remediation closes. Patient-data confidentiality remains the load-bearing impact dimension.
Recommendation
Pursue Option 2 — accelerate remediation. The 2 engineer-weeks of effort cost is recoverable in Q3; the residual exposure is asymmetric (regulatory floor of $1.4M vs. ~$120K labor delta). Document the patch-cycle re-prioritization as a logged decision with the program owner; close the SOC-2 attestation gap via vendor outreach in the same window. Insurance rider deferred to Q4 review.
Evidence
Twelve evidence artifacts back the recommendation — asset inventory, control mapping, vendor SOC-2 status, residual-risk model, patch-cycle telemetry, and the prior packet's audit trail. One control attestation is overridden with a documented compensating-control narrative; two vendor attestations are pending the Q2 refresh window.
| Artifact | Hash | Status | Detail | Captured |
|---|---|---|---|---|
| Asset inventory snapshot — 487 endpoints | #a3f8e1b2 | verified | — | |
| Control mapping cross-walk — 93 controls | #b7c4d9e0 | verified | — | |
| Vendor SOC-2 attestation — current | #c9d0e2f1 | pending | Refresh window opens 2026-05-12; vendor confirmed window… | |
| Vendor SOC-2 attestation — secondary processor | #d2e3f4a5 | pending | — | |
| Residual-risk model — revenue-at-risk | #e1f2a3b4 | verified | — | |
| Patch cycle #38 — CAB queue position | #f3a4b5c6 | overridden | — | |
| Overridden per compensating-control narrative — see attached | ||||
| Penetration test report — Q1 follow-up | #a5b6c7d8 | stale | — | |
| Prior packet audit trail — pkt_2026-01-09_b8c4e2 | #b6c7d8e9 | verified | — | |
Approval Chain
CIO and CISO have signed. The CCO signature is pending receipt of the vendor-SOC-2 refresh; the program owner has logged the override and the compensating-control narrative.
- Chief Information OfficerM. AlvarezSigned 2026-04-17T14:08:11Z
- Chief Information Security OfficerJ. ParkSigned 2026-04-17T14:18:42Z
- Chief Compliance Officer—Pending signatureAwaiting vendor SOC-2 refresh — window opens 2026-05-12