{"id":3973,"date":"2026-10-31T03:00:00","date_gmt":"2026-10-31T03:00:00","guid":{"rendered":"https:\/\/www.bestcardiachospitals.com\/blog\/?p=3973"},"modified":"2026-10-31T03:00:00","modified_gmt":"2026-10-31T03:00:00","slug":"secops-seven-numbers-review-meeting","status":"publish","type":"post","link":"https:\/\/www.bestcardiachospitals.com\/blog\/secops-seven-numbers-review-meeting\/","title":{"rendered":"Seven SecOps Numbers From One Review Meeting"},"content":{"rendered":"

The monthly systems-and-safety review at a mid-sized hospital network usually runs to forty slides. Last September, the quality chief cut it to seven numbers, projected on the same screen the morbidity meetings use, and the argument that followed was the healthiest the IT department had ever witnessed. The numbers come from the worked September example published by the Ops Atlas \u2014 the reference project that gives SecOps<\/strong> its working definition, a contract binding security with operations \u2014 and this post retells them the way they landed in that meeting room, because numbers only change behaviour when someone stands up and defends them. Seven numbers, seven small stories, one scoreboard worth stealing for any hospital IT committee.<\/p>\n

1. The 82.5% that opened the meeting<\/h2>\n

First slide, and it looked like a victory lap: 198 of 240 remediation items closed on time, or 82.5% overall. The IT director had half a mind to stop there. The quality chief did not hire him to stop there. An average, she said, is a way of not looking at anything in particular \u2014 and she asked for the cut that NIST effectively demands, since NIST dismisses the classic estate-wide number, the “percent patched” figure, as not actionable. What the cells said next is the reason this post exists.<\/p>\n

2. Two SecOps cells, twenty points apart<\/h2>\n

Same estate, same month: internet-facing systems at high urgency ran at 95% on time. The datacentre’s high-urgency cell ran at 75%. Nothing about the staff, the tools, or the workload explained twenty points. One thing did: the datacentre’s change window kept slipping, so the work had nowhere to land. The room understood the lesson without help \u2014 a deadline only works when the calendar gives it a home, and the facility-grade discipline that fills the cardiac ICU guidelines this network already runs by applies to servers just as it does to ventilators. Twenty points, one meeting, one protected slot on the change calendar: the cell crossed the line within two months, which is the fastest cultural win the IT department can remember.<\/p>\n

3. The 18 findings nobody owned<\/h2>\n

Third number: 600 open findings, 18 of them with no owner attached. Three percent sounds forgiving until you ask what a finding with no owner is \u2014 not a slow fix, but a fix that will never happen, because a ticket without a name is a hope, not a plan. The atlas’s contract language is blunt on this point: one queue, every item owned and dated. The network’s response was to print the ownerless list weekly until the number hit zero, which took five weeks and no money whatsoever \u2014 the cheapest quality improvement the committee had ever approved, and the only one nobody tried to adjourn.<\/p>\n

4. Six exceptions living past their review date<\/h2>\n

Fourth: of 35 approved exceptions, 6 had drifted past their review dates \u2014 seventeen percent of the exception book running on hope and muscle memory. Exceptions are legitimate clinical tools; a leased imaging workstation that cannot take a hardening setting is real life. But an exception is a loan, not a gift, and the register now counts the overdue ones in the monthly pack, next to the unowned count. Loans, the quality chief noted, get repaid; gifts quietly become furniture.<\/p>\n

5. Ninety-six point two five percent telemetry, and a subsidiary nobody scanned<\/h2>\n

Fifth: 1,540 of 1,600 machines reporting telemetry, or 96.25%. Good number, almost excellent. The sixty silent machines were all one thing \u2014 an acquired subsidiary whose estate had never been onboarded for scanning. The room’s collective shrug was the point of the slide: coverage numbers are how an estate admits what it cannot see. A hospital that cannot see a ward cannot treat it; an IT estate that cannot see sixty machines cannot secure them, whatever the percentage says. The subsidiary’s onboarding went onto the register with an owner and a date that same afternoon \u2014 the meeting’s only unanimous vote.<\/p>\n

6. Three outages out of 120 SecOps changes<\/h2>\n

Sixth, the counter-metric nobody tracks until it is too late: disruption caused by security work itself. Three incidents in 120 changes, or 2.5% \u2014 and all three led back to one estate-wide baseline that was pushed with no pilot ring. The incident review took one sentence: big-bang hardening is not diligence, it is improvisation with paperwork. Ring-by-ring staging, log-only first, went into policy the same afternoon, and the monitoring stack got its overdue thanks, since the advanced heart monitoring technology<\/a> mindset \u2014 watch continuously, intervene early \u2014 is the same one that makes telemetry worth funding rather than resenting.<\/p>\n

7. The empty list that closed the meeting<\/h2>\n

Seventh number was not from September at all. The IT director closed with the Netlogon precedent: Microsoft’s CVE-2020-1472 campaign ran enforcement in phases from 11 August 2020, logged denied and permitted connections separately (events 5827, 5828, 5829, 5830, 5831), and held the irreversible step until 9 February 2021 \u2014 with one success condition: the exception list empty before the deadline. An empty list, he argued, is the most honest scoreboard security work has ever produced, because nobody can decorate it, inflate it, or argue it into a better shape. The board asked for the network’s own equivalent lists \u2014 ownerless findings, stale exceptions, unscanned machines \u2014 on one page each month. That page is now the meeting, and the forty-slide deck has quietly retired to a drawer with the fax machine.<\/p>\n

What a hospital committee should copy from this SecOps pack<\/h2>\n

For any clinical governance group wanting the same seven-number discipline, the starter set fits on an index card:<\/p>\n