October 28, 2026

10 Insights from the 2025 Healthcare Cybersecurity Benchmarking Study

The article states the sample size beside each result, from 69 organizations down to 13 for the AI framework, and describes the premium finding as an association. This wiki entry restates each section, notes which results rest on small samples, and records the figures with their source, so teams can cite the study accurately.

What does the article cover, and what is the 2025 study?

The article walks through ten insights from the Executive Summary of the Healthcare Cybersecurity Benchmarking Study 2025, a partnered report from KLAS Research and Censinet with the American Hospital Association. It opens with its central finding: “Healthcare organizations are better prepared to respond to a cyberattack than to prevent one.” The study surveyed 69 healthcare and payer organizations from September to December 2024 and measured self-reported coverage of four frameworks: NIST CSF 2.0, the HHS Healthcare and Public Health Cybersecurity Performance Goals, the Health Industry Cybersecurity Practices, and the NIST AI Risk Management Framework. It says the HPH CPGs and the NIST AI RMF were measured for the first time. Co-sponsors named are Censinet, KLAS Research, the American Hospital Association, Health-ISAC, the Healthcare and Public Health Sector Coordinating Council, and the Scottsdale Institute. The article groups its insights by framework, uses six tables to show the coverage figures, states the sample size beside each, and cites the Executive Summary as a single numbered reference. All figures are average self-reported coverage unless noted, so the numbers describe what organizations reported about their own programs rather than audited results.

What does the article report for NIST CSF 2.0 coverage?

The first four insights cover NIST CSF 2.0 and use the 69-organization sample. Respond is highest at 85%, followed by Recover at 78%, Detect at 74%, and Protect at 69%, while Govern and Identify tie at 64%, against an overall average of 72%. The article says the gap between Respond and the other functions is wider than in earlier years, and it states: “This is the third consecutive year that Identify has had the lowest coverage.” Govern is new in NIST CSF 2.0. Asset Management, in the Identify function, averages 53% and Supply Chain Risk Management, now in the Govern function, averages 52%, against 73% for all other categories combined. The article says these two categories have had the lowest coverage for the third consecutive year and ties the supply chain figure to rising third-party breaches. Incident Recovery Communication reaches 83% while Incident Recovery Plan Execution reaches 76%, so organizations keep stakeholders informed during recovery more reliably than they coordinate the work of restoring operations. The article explains that asset management means a detailed inventory of all assets, including third-party hardware, software, data, and storage systems.

How does the article treat insurance premiums and the HPH CPGs?

The fifth insight compares cyber insurance premium growth. Organizations using NIST CSF 2.0 as their primary framework (n=36) reported average annual premium increases of 3%, while those that did not or had not adopted it (n=33) reported 11%. The article adds: “This is an association in survey data and does not show cause.” It notes that the 2024 study showed similar results for NIST CSF 1.1 users. The sixth and seventh insights cover the HPH CPGs. The Essential Goals average 78%, and Vendor/Supplier Cybersecurity Requirements is the exception at 65%, while the other nine Essential Goals range from 74% to 83%. Among the Enhanced Goals, Network Segmentation has the lowest coverage across both goal types at 56%, followed by Configuration Management and Third Party Vulnerability Disclosure at 61%, Asset Inventory at 62%, and Third Party Incident Reporting at 64%. The article says segmentation can be complex and can require significant infrastructure investment, yet it can compensate for asset vulnerabilities, for example by restricting the internet access of medical or legacy devices that no longer receive security patches.

What does the article say about HICP and medical device security?

The eighth insight covers HICP and carries a smaller sample. The article states: “The HICP section of the study was optional, so its sample is 32 organizations.” Email Protection Systems has the highest coverage at 86%, followed by Cybersecurity Oversight and Governance at 83%, Identity and Access Management at 78%, and Vulnerability Management at 77%. Network Connected Medical Device Security has the lowest coverage at 48%, below Data Protection and Loss Prevention at 58%, and it has lagged the other practices for three consecutive years. The average across the ten practices is 70%. The article says this result supports the NIST CSF 2.0 and HPH CPG findings that third-party risk management and asset management still lag in industry coverage. A table lists all ten practices with their coverage, so readers can see the full spread rather than only the highest and lowest values. The article ties the device result back to the same asset and third-party themes that appear in the NIST CSF 2.0 and HPH CPG sections, and it keeps the HICP figures separate from the 69-organization results.

What does the article report on AI risk management?

The ninth and tenth insights cover the NIST AI RMF. Thirteen organizations opted to answer that section, and the article says the figures describe a small group that chose to respond, not the industry as a whole. Average coverage is 39% for Govern, 33% for Map, 28% for Manage, and 24% for Measure, an average of 31%. The article says this fits respondents starting with governance around the use, development, and deployment of AI, and it adds that many face challenges with risk remediation because of uncertainties surrounding AI. On ownership, it says cybersecurity programs see more success when the CISO has high ownership, while AI programs do better with cross-departmental ownership that includes stakeholders outside cybersecurity, because AI also presents risks tied to data bias and transparency, clinical workflows, privacy, and ethics. It then lists five emerging best practices from Censinet: a dedicated AI governance committee, diligence on vendors with AI capabilities, a streamlined subject matter expert review process, a central repository of AI vendors and products, and reassessment of AI vendors by criticality or when functionality changes.

What does the article conclude, and how does it describe Censinet and its sources?

The closing section says three of the four frameworks point to the same two gaps, third-party risk and asset visibility, and it names four places to start: a complete asset inventory that includes third-party assets, written cybersecurity requirements for vendors, segmentation for medical and legacy devices that cannot be patched, and AI governance owned across departments. This conclusion is the article’s own synthesis of the report’s results. The article then describes what study participants receive: a full report with financial ratios and operational metrics, such as the share of the IT budget and workforce allocated to cybersecurity, peer comparisons of organizational structure and functional ownership, root cause insight, personalized remediation plans, tailored reports for executive and board communication, and enhanced peer group comparisons. It describes Censinet RiskOps™ as a cloud-based risk exchange of healthcare organizations working together and notes that Censinet is an American Hospital Association Preferred Cybersecurity Provider. The article cites one numbered reference, the Executive Summary, and links to the Censinet RiskOps™ product page and the peer benchmarking page.

Healthcare organizations are better prepared to respond to a cyberattack than to prevent one. In the Healthcare Cybersecurity Benchmarking Study 2025, average self-reported coverage of the NIST CSF 2.0 Respond function was 85%, while the Govern and Identify functions averaged 64%. Supply chain risk management (52%) and asset management (53%) were the two lowest-scoring categories.

The study surveyed 69 healthcare and payer organizations from September to December 2024. It is co-sponsored by Censinet, KLAS Research, the American Hospital Association, Health-ISAC, the Healthcare and Public Health Sector Coordinating Council, and the Scottsdale Institute. It measures coverage of four frameworks: NIST CSF 2.0, the HHS Healthcare and Public Health Cybersecurity Performance Goals (HPH CPGs), the Health Industry Cybersecurity Practices (HICP), and the NIST AI Risk Management Framework (NIST AI RMF). The HPH CPGs and the NIST AI RMF were measured for the first time.

Below are ten insights from the study's Executive Summary, with the figures behind each one. All figures are average self-reported coverage unless noted, and the sample is 69 organizations except where a different n is shown^[1].

NIST CSF 2.0

1. Organizations are more reactive than proactive

The report finds that healthcare organizations continue to be more reactive than proactive. Coverage is strongest where organizations plan for an incident and weakest where they set strategy and track what they own. The gap between Respond and the other functions is wider than in earlier years, as organizations prepare for when, not if, they need to respond to an incident.

NIST CSF 2.0 function coverage
NIST CSF 2.0 function	Average coverage (n=69)
Respond	85%
Recover	78%
Detect	74%
Protect	69%
Govern	64%
Identify	64%
Overall average	72%

‍

2. Identify has the lowest coverage for a third year

Govern, a new function in NIST CSF 2.0, ties with Identify at 64%. This is the third consecutive year that Identify has had the lowest coverage.

3. Supply chain and asset management trail every other category

Lowest-coverage NIST CSF 2.0 categories
NIST CSF 2.0 category	Average coverage (n=69)
Asset Management (Identify function)	53%
Supply Chain Risk Management (Govern function)	52%
All other categories, aggregate	73%

‍

For the third consecutive year, these two categories have the lowest coverage. The report calls the low supply chain figure especially concerning because third-party breaches in healthcare have increased year over year. It describes asset management as keeping a detailed inventory of all assets, including third-party hardware, software, data, and storage systems, which lets an organization find and address vulnerabilities in third-party products and services. In NIST CSF 2.0, supply chain risk management moved from the Identify function to the new Govern function.

4. Recovery communication is stronger than recovery execution

Organizations report 83% coverage of Incident Recovery Communication and 76% of Incident Recovery Plan Execution, compared with 73% for all other categories combined. Organizations generally keep stakeholders informed during recovery. Coordinating teams, resources, and activities to fully restore operations is the area to improve.

5. Primary NIST CSF 2.0 adopters report lower insurance premium increases

Cyber insurance premium change by primary framework
Group	Average annual change in cyber insurance premiums
Uses NIST CSF 2.0 as primary framework (n=36)	3%
Does not use it as primary framework, or has not adopted it (n=33)	11%

‍

The report describes primary adoption of NIST CSF 2.0 as connected to lower premium growth. This is an association in survey data and does not show cause. The 2024 study showed similar results for organizations using NIST CSF 1.1 as their primary framework.

HPH CPGs

6. Vendor requirements are the weakest Essential Goal

The Essential Goals average 78% coverage (n=69). Vendor/Supplier Cybersecurity Requirements is the exception at 65%. The other nine Essential Goals range from 74% (Mitigate Known Vulnerabilities) to 83% (Multifactor Authentication).

7. Network segmentation has the lowest coverage of any goal

Network Segmentation, an Enhanced Goal, has the lowest coverage across both goal types at 56%. Other Enhanced Goals tied to asset and third-party risk also fall below the Essential Goals.

HPH CPG Enhanced Goals with the lowest coverage
Enhanced Goal	Coverage (n=69)
Network Segmentation	56%
Configuration Management	61%
Third Party Vulnerability Disclosure	61%
Asset Inventory	62%
Third Party Incident Reporting	64%

‍

The report notes that network segmentation can be complex and can require significant infrastructure investment. It can also compensate for asset vulnerabilities. For example, segmenting medical or legacy devices that no longer receive security patches restricts their access to the internet and other critical systems, which lowers risk.

HICP

8. Medical device security is the lowest-covered HICP practice

The HICP section of the study was optional, so its sample is 32 organizations. Email protection systems had the highest coverage at 86%. Network Connected Medical Device Security had the lowest at 48%, and it has lagged the other practices for three consecutive years. The report says this supports the NIST CSF 2.0 and HPH CPG findings that third-party risk management and asset management still lag in industry coverage.

HICP practice coverage
HICP practice	Coverage (n=32)
Email Protection Systems	86%
Cybersecurity Oversight and Governance	83%
Identity and Access Management	78%
Vulnerability Management	77%
Security Operations Center and Incident Response	73%
Endpoint Protection Systems	68%
IT Asset Management	66%
Network Management	63%
Data Protection and Loss Prevention	58%
Network Connected Medical Device Security	48%
Average	70%

‍

NIST AI RMF

9. AI risk management is in its early stages

Thirteen organizations opted to answer the NIST AI RMF section. Their coverage is highest in Govern, which fits the report's finding that respondents began with governance around the use, development, and deployment of AI. The report adds that many face challenges with risk remediation because of uncertainties surrounding AI. Because only 13 organizations answered, these figures describe a small group that chose to respond, not the industry as a whole.

NIST AI RMF function coverage
NIST AI RMF function	Average coverage (n=13)
Govern	39%
Map	33%
Manage	28%
Measure	24%
Average	31%

‍

10. AI programs need broader ownership than cybersecurity programs

Cybersecurity programs see more success when the CISO has high ownership. The report finds that AI programs do better with cross-departmental ownership that includes stakeholders outside cybersecurity, because AI also presents risks tied to data bias and transparency, clinical workflows, privacy, and ethics.

Censinet lists these emerging best practices for managing AI risk^[1]:

stablish a dedicated AI governance committee with broad stakeholder representation across business functions.
Determine which vendors have AI capabilities that need additional diligence.
Identify which subject matter experts need to review which AI risks, and create a streamlined review process.
Maintain a central repository of vendors and products that use AI, and track diligence efforts and risk findings in it.
Reassess AI vendors based on criticality or when their functionality changes.

What the results mean for a security program

Three of the four frameworks in the study point to the same two gaps: third-party risk and asset visibility. NIST CSF 2.0 shows them in Supply Chain Risk Management and Asset Management, the HPH CPGs show them in vendor requirements, asset inventory, and third-party reporting goals, and HICP shows them in medical device security and IT asset management. Taken together, the lowest-coverage areas give a program four places to start: a complete asset inventory that includes third-party assets, written cybersecurity requirements for vendors, segmentation for medical and legacy devices that cannot be patched, and AI governance owned across departments rather than by security alone.

How benchmarking works with Censinet

Participants in the Healthcare Cybersecurity Benchmarking Study receive a full report that includes a detailed analysis of financial ratios and operational metrics, such as the percentage of the IT budget and workforce allocated to cybersecurity. It also includes peer comparisons of IT and cybersecurity organizational structure and functional ownership, and insight into the root causes behind coverage gaps. Participants also receive personalized remediation plans, tailored reports to prioritize cybersecurity investments and support executive and board communications, and enhanced peer group comparisons^[1].

Censinet describes Censinet RiskOps™ as a cloud-based risk exchange of healthcare organizations working together to manage and mitigate cyber risk, and notes that it is an American Hospital Association (AHA) Preferred Cybersecurity Provider^[1]. [Learn more about Censinet RiskOps™](https://www.censinet.com/provider-solutions/censinet-riskops) or [join the benchmarking study](https://www.censinet.com/capabilities/healthcare-cybersecurity-peer-benchmarking).

Key points

What is the Healthcare Cybersecurity Benchmarking Study 2025?

It is a partnered report from KLAS Research and Censinet, with the American Hospital Association, that measures self-reported coverage of cybersecurity frameworks and best practices. Data comes from 69 healthcare and payer organizations surveyed from September to December 2024.

Which frameworks does the study measure?

It measures NIST CSF 2.0, the HPH CPGs, HICP, and the NIST AI RMF. The HPH CPGs and NIST AI RMF were measured for the first time in 2025.

Where are healthcare organizations weakest?

Supply Chain Risk Management (52%) and Asset Management (53%) had the lowest coverage among NIST CSF 2.0 categories. Network Segmentation (56%) had the lowest HPH CPG coverage, and Network Connected Medical Device Security (48%) had the lowest HICP coverage.

Where are they strongest?

Respond had the highest NIST CSF 2.0 coverage at 85%. Multifactor Authentication (83%) and Basic Cybersecurity Training (82%) led the HPH CPG Essential Goals, and Email Protection Systems (86%) led HICP.

What does the study say about cyber insurance premiums?

Organizations using NIST CSF 2.0 as their primary framework reported average annual premium increases of 3% (n=36), compared with 11% (n=33) for those that did not. The report describes this as connected to preparedness and does not claim cause.

What does the study show about AI risk management?

The 13 organizations that answered the NIST AI RMF section averaged 31% coverage, highest in Govern (39%) and lowest in Measure (24%). The report recommends cross-departmental ownership of AI programs.

Reference

[1] KLAS Research and Censinet, with the American Hospital Association. Healthcare Cybersecurity Benchmarking Study 2025, Executive Summary (April 2025). Co-sponsored by Censinet, KLAS Research, the American Hospital Association, Health-ISAC, the Healthcare and Public Health Sector Coordinating Council, and the Scottsdale Institute. https://censinet.com/2025-healthcare-cybersecurity-benchmarking-study-executive-summary