The proposed update to the HIPAA Security Rule and the rollout of the Cybersecurity Maturity Model Certification, better known as CMMC, both raise expectations for how cybersecurity is managed. They also move the conversation beyond written policies. Leaders need to understand what information they hold, where it moves, who can access it, and whether the protections surrounding it can be verified.
That is as much of a business issue as it is a technology issue. Patient trust, contract eligibility, operational continuity, and revenue can all depend on getting it right.
Two Regulatory Paths, One Clear Direction
It’s important to separate what is final from what is still proposed. CMMC is in active implementation. The Department of Defense began its phased rollout on November 10, 2025. Phase 2 is scheduled to begin November 10, 2026, when requirements for Level 2 certification assessments by authorized third-party assessors are expected to appear in applicable contracts.
The required level and assessment type depend on the solicitation and the kind of federal information a company will process, store, or transmit. These requirements may also flow down to subcontractors, including smaller manufacturers, engineering firms, and service providers that may not immediately think of themselves as part of the defense supply chain.
The HIPAA Security Rule update remains a proposal as of this writing, and the current Security Rule remains in effect. Even so, the proposal offers a useful view of where healthcare cybersecurity expectations are heading. It calls for more specific, documented, and testable measures, including asset inventories, network maps, multi-factor authentication, encryption, vulnerability scanning, penetration testing, network segmentation, and incident response planning. The proposal would also require written procedures for restoring certain critical systems and data within 72 hours, placing greater emphasis on continuity and recovery following a disruption.
Both developments extend well beyond the IT department. A compliance requirement may start with a regulation or contract clause, but it quickly reaches operations, finance, legal, human resources, vendors, and executive leadership.
The Real Shift Is From Intention to Evidence
For years, many organizations have been able to say they take cybersecurity seriously. The harder question is whether they can show it.
Can you produce an accurate inventory of devices, applications, and systems? Can you trace where sensitive data is stored and how it travels? Can you show that access is removed when an employee leaves? Can you demonstrate that backups are protected and recoverable? Can you document when security measures were tested and how weaknesses were addressed?
Those questions reveal what it takes to operate a security program. A company may have a firewall, endpoint protection, backups, and multi-factor authentication. A defensible security posture also depends on whether those tools cover the right systems, are configured properly, are monitored consistently, and support a documented process.
This is where leadership matters. Someone has to define ownership, decide which risks receive attention first, and make sure improvements are tied to business priorities. Cybersecurity becomes much easier to manage when it’s treated as an ongoing operating discipline rather than a project that ends after an assessment.
Five Disciplines Both Sectors Should Strengthen
HIPAA and CMMC apply different requirements, yet both depend on several of the same foundational disciplines.
- Know your environment. Maintain an accurate inventory of hardware, software, cloud services, vendors, users, and data flows. Clear visibility makes it easier to identify gaps and determine what falls within the scope of compliance.
- Control identity and access. Use multi-factor authentication, least-privilege access, role-based permissions, and a reliable process for adding, changing, and removing access.
- Limit the path of an attack. Network segmentation and thoughtful system design can reduce how far an attacker can move if one account or device is compromised.
- Prepare to respond and recover. Establish clear incident response procedures, protect backups, define recovery priorities, and test those plans regularly.
- Document and validate. Policies should reflect what is actually happening. Audit trails, test results, remediation records, and assigned owners help demonstrate that the security program is active and being maintained.
Start With the Business Impact
Compliance discussions often become overly technical too quickly. Business leaders don’t need to memorize every control. They do need to understand which operations, contracts, data, and revenue streams are in scope.
For a healthcare provider, a disruption can delay care, divert patients, and damage trust. For a defense contractor, an unmet CMMC requirement may affect its ability to compete for or maintain applicable work. In both cases, leaders should ask what a cybersecurity or compliance failure could interrupt and how much that interruption could cost.
The answers help establish priorities. Effective planning focuses on the most meaningful gaps, solutions suited to the existing environment, and a roadmap the business can realistically maintain. Each technology decision should support compliance obligations while also improving security, efficiency, and resilience.
Preparation Should Begin Before the Deadline
Waiting for a contract requirement or final rule may feel efficient, but cybersecurity readiness takes time. Older systems may need to be updated or replaced. Access practices may need to change. Vendors have to be reviewed, employees need training, and documentation has to reflect how the business actually operates.
A practical first step is a structured gap assessment. This process can help determine what information and systems are in scope, compare current practices with applicable requirements, rank gaps by business risk, and assign clear owners and timelines.
The results can also show which improvements an internal team can manage and where outside guidance, specialized tools, or an authorized assessor may be needed.
Technology consulting, legal guidance, and formal certification each play a different role in the process. A technology partner can help evaluate infrastructure, security controls, vendors, monitoring, backup, and recovery. Legal counsel and qualified compliance professionals can confirm regulatory interpretations and certification requirements.
A Stronger Program Is the Lasting Outcome
Regulations and contract requirements create urgency. The lasting value comes from building a security program that helps the business understand risk, respond faster, protect sensitive information, and make better technology decisions.
Healthcare providers and defense contractors have different missions. Both depend on trust and reliable operations.
Preparing early gives their leaders more time to address gaps in a logical order, budget effectively, and make thoughtful decisions before a deadline creates an emergency.
Stronger compliance should ultimately support a more secure, resilient, and prepared business.
Looking for a clearer view of your technology and security posture? Higher Information Group helps businesses evaluate their environments, identify gaps, and align technology decisions with business goals.
