Privacy & Cybersecurity Law Blog

On February 23, 2026, the Administration for Strategic Preparedness and Response (“ASPR”), a division of the U.S. Department of Health and Human Services (“HHS”), announced a new cybersecurity module within its Risk Identification and Site Criticality (“RISC”) 2.0 Toolkit.

ASPR introduced the module to help health care and public health organizations assess and strengthen cybersecurity practices as cyber threats continue to increase in frequency and complexity. ASPR leadership emphasized that cybersecurity directly impacts patient safety and broader health system resilience.

The new cybersecurity module:

• guides users through structured questions regarding cybersecurity policies and practices;
• aligns responses with the National Institute of Standards and Technology Cybersecurity Framework 2.0 and HHS Cybersecurity Performance Goals;
• provides scoring to help identify gaps and prioritize risk mitigation efforts; and
• enables organizations to evaluate cyber risk alongside other operational risks within a single platform.

ASPR stated that the module is designed to support health care entities in identifying vulnerabilities, prioritizing cybersecurity investments, and improving preparedness to reduce disruptions to patient care.