Best Practices Framework for
Health Care Cyber Protection of MEP Systems

Cyber-risk mitigation is least expensive and most effective when implemented at the initial planning stage of a project. This monograph introduces best practices to mitigate cyber-risk for mechanical, electrical and plumbing (MEP) systems. Vulnerabilities to health care MEP cyberthreat include the disabling of a life safety system, equipment damage, disruption of facility operations or a cyber entry point to a larger hospital network. Cyber-risk increases as buildings and equipment become smarter, more connected and more reliant on networks.

This document outlines a team approach, starting with the health care organization leadership setting the expectations and cyber-risk mitigation tone for the project. When executive leadership empowers information technology, operational technology and facilities professionals, an effective cyber-risk mitigation plan can be enacted. A thoughtful cyber-risk process addresses the safety, efficiency and compliance goals of the health care facility.

This monograph is based on a holistic design and construction process to set up owner operations for success. While it is directed toward new construction projects, the principles may be applicable elsewhere.