The IHS Telehealth System Was Deployed Without Some Required Cybersecurity Controls

The Indian Health Service should develop a strategy for expeditiously deploying a new information system when it is necessary to meet an urgent, mission-critical need. The strategy should define the minimum set of controls out of the total number of required controls that should be addressed and, if applicable tested, before the new system is authorized to operate until it is feasible to address all required controls. The authorization to operate should include an acceptance of risk for not implementing all required controls, specify a date by which the remaining required controls will be implemented and tested, and be replaced with a new authorization to operate once all the required controls have been addressed.