Board members and executive teams are often asked to oversee cybersecurity without a technical background. They do not need to understand firewall rules. They do need a few reliable numbers that show whether risk is moving in the right direction. The trick is choosing measures that are easy to understand, hard to game and tied to real protection.
Below are five indicators a healthcare or senior-living leadership team can track, with an explanation of what each means, how to read it and what questions to ask.
What it is: the percentage of user accounts that require a second step to sign in, such as an authenticator app, beyond a password.
Why it matters: stolen passwords are among the most common ways attackers get in. A second factor stops many of those attempts.
How to read it: the target is every account, with particular attention to email, remote access, the EHR and administrator accounts. A figure below 100 percent should come with a list of exceptions and a date to close them.
Questions to ask: which accounts are excluded, and why? Are administrators protected by stronger methods?
What it is: the share of computers and servers that have received critical security updates within the target window, such as 14 or 30 days.
Why it matters: many attacks exploit known flaws for which a fix already exists. Delay is exposure.
How to read it: look at the trend and at the oldest unpatched systems. A few devices that cannot be updated, such as legacy medical or building equipment, should be named with a plan to isolate or replace them.
Questions to ask: what is the target window? What is being done about the exceptions?
What it is: two linked figures from simulated phishing exercises and real reports: how many staff clicked or entered credentials, and how many reported the message.
Why it matters: staff are a primary defense. Click rates alone can mislead, and a rising reporting rate shows a healthier culture.
How to read it: expect the click rate to fall and the report rate to rise over time. Do not use the numbers to punish individuals.
Questions to ask: who has not completed training? Are new hires included in the first month?
What it is: the percentage of critical systems backed up successfully, and the date of the last successful test restore.
Why it matters: backups are the difference between an inconvenience and a catastrophe in a ransomware event. A backup that has never been restored is an untested assumption.
How to read it: success should be near complete, and restore tests should occur at least on a regular schedule, with results recorded. Ask whether backups are protected from tampering, for example by keeping a copy offline or immutable.
Questions to ask: how long would it take to restore the EHR or core systems, and have we practiced?
Choose one of these depending on your maturity.
Open high-risk findings: the number of serious issues from scans, assessments or your HIPAA risk analysis that remain open, with their age. Leadership should see the count falling and any item older than the target flagged.
Time to respond: how quickly security alerts are reviewed and incidents contained, if your provider tracks this.
Why it matters: finding problems is only useful if they are fixed. Aging risk items show whether security work is getting done.
Questions to ask: what are the top three open risks, who owns them and when will they be closed?
A board slide works best with:
Each metric as a simple number or small trend line.
A color or arrow showing improved, flat or worse compared with the prior period.
One sentence about what changed and why.
A short list of decisions or support requested.
Keep definitions stable so the quarter-to-quarter comparison is fair. Note any change in how a number is calculated.
Do not present a long list of technical statistics without explanation.
Do not rely on a single number as proof of safety.
Do not hide bad news. A red number with a plan is more useful than a green one that nobody trusts.
Do not forget that the numbers support, not replace, a documented risk analysis and incident response plan. The NIST Cybersecurity Framework and the HHS 405(d) Health Industry Cybersecurity Practices are useful references for choosing and organizing measures.
If you cannot produce all five today, begin with those you can, and note the rest as gaps to close. UnityCare IT helps healthcare and senior-living organizations in Oklahoma, Texas and Arkansas collect these numbers and present them in plain language, so leadership can see where things stand and where to invest next.
Security monitoring, HIPAA safeguards, backups and staff training for healthcare and small businesses.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: UnityCare Technologies, 2524 N Broadway Ste 554, PMB 947974, Edmond, Oklahoma 73034-4172