Skip to main content

New RISC 2.0 Cyber Module Will Help Strengthen Health Care Facilities’ Cybersecurity

FOR IMMEDIATE RELEASE
Contact ASPR Press Office

ASPRMedia@hhs.gov
aspr.hhs.gov/newsroom
X: @ASPRgov

New RISC 2.0 Cyber Module Will Help Strengthen Health Care Facilities’ Cybersecurity

Washington, D.C. (Feb. 23, 2026) -- Today, the Administration for Strategic Preparedness and Response (ASPR), a division of the U.S. Department of Health and Human Services, is introducing a new cybersecurity module within the Risk Identification and Site Criticality (RISC) 2.0 Toolkit.

“Cyber threats are growing more sophisticated. This module is the latest addition to our toolkit of resources to assist our health care and public health partners in preventing the disruption of patient care and strengthening national health security, ” says ASPR Principal Deputy Assistant Secretary John Knox. “We must acknowledge that cyber safety is patient safety and that cyber threats can cause cascading problems across the health care industry. The new cybersecurity module will help our partners understand what is needed to strengthen their resilience and we strongly encourage them to take advantage of it. ”

RISC 2.0 is a free, web-based platform where organizations can conduct risk assessments by identifying threats, assessing vulnerabilities, determining consequences and criticality, and sharing findings with stakeholders. Currently more than 3,500 Health Systems are using the RISC Tool.

The new cybersecurity module guides users through a series of questions about their policies and practices, scoring responses against the NIST Cybersecurity Framework 2.0 and HHS Cybersecurity Performance Goals. This objective, standards-based approach helps organizations identify critical gaps, prioritize investments, and make informed decisions about risk mitigation. When health care organizations have the means to identify risks and vulnerabilities, they can implement strategies that minimize disruptions to patient care and strengthen preparedness and resilience.

Integrated into the existing RISC 2.0 platform, the module allows facilities, health systems, and coalitions to analyze cyber risk alongside other hazards in one unified tool. Users can complete the cyber module questionnaire independently or in combination with other risk assessments, depending on need.

HHS is the Sector Risk Management Agency (SRMA) for the Health Care and Public Health Sector and ASPR coordinates HHS SRMA activities and provides guidance and support to public and private partners to help enhance cybersecurity. To learn more about RISC 2.0 or the cyber module, or if you are an organization interested in using the tool, visit: https://aspr.hhs.gov/RISC/Pages/default.aspx.

About ASPR:

ASPR is the nation’s lead health security agency—driving preparedness before disaster strikes, securing domestic medical supply chains, advancing gold standard science, and delivering a fast, accountable federal response when lives are on the line. We partner with states, local communities, tribes, territories, other federal agencies, and the private sector to strengthen readiness at home. We invest in American manufacturing to reduce foreign dependency, and steward taxpayer resources with transparency, discipline, and measurable outcomes. ASPR protects the American people and ensures that the United States can prepare for, respond to, and recover from any threat to national security, anytime, anywhere.


# # #

How PAHPA Strengthened State and Local Resilience Through Workforce Flexibility

How PAHPA Strengthened State and Local Resilience Through Workforce Flexibility

Renewing the Flexible Workforce Authority That Empowers States to Save More Lives

As we look at the 20th anniversary of the Pandemic and All Hazards Preparedness Act (PAHPA), it’s easy to recognize some of the most tangible results that benefited State and local communities: new medicines, cutting-edge diagnostic tools, stockpiles filled with medical countermeasures, and ultimately, lives saved.

PAHPA's legacy extends beyond what we can see and touch. It extends beyond the programs, plans, and training we have built because of the authorities it granted. At its core, PAHPA gave us something even more fundamental: the legal authority to act when it matters most.

Because of PAHPA’s cycle for reauthorization, there are times when we can all collectively examine best practices and identify gaps in authorities to ensure we continue to move forward in providing the best support to those in need.

One example is when we had an outbreak of H1N1 in 2009. States and territories requested permission to use federally funded personnel to augment their response efforts. Unfortunately, our hands were tied. There was no authority to permit the use of those personnel for duties outside their original funding purposes. This was a technical gap in the baseline authorities — there was no emergency use clause or other consideration for flexible surge.

Expanding PAHPA’s Authorities

The 2013 Pandemic and All-Hazards Preparedness Reauthorization Act (PAHPRA) amended the Public Health Service Act (PHSA) to add much needed flexibility. Under this amendment, governors and tribal leaders could request temporary reassignment of federally funded public health personnel when a public health emergency was declared. In simple terms, upon request from a governor, tribal leader, or their designee, federally funded state and local personnel can be temporarily reassigned to immediately address emergency needs. 

The impact has been measurable.

Most states and U.S. territories have used this authority since 2020. Across jurisdictions, over 65,000 full-time equivalents have been reassigned to support disaster response operations. During declared public health emergencies, these personnel directly contributed to State and local resilience. Personnel disseminated vital communications to communities, connected health care systems with data, guidance, and medical supplies and equipment, enhanced coordination among public health, emergency management, and healthcare partners, staffed public hotlines, and performed many other duties to mitigate gaps in health care and community health needs.

Temporary reassignment does not create new positions. It allows jurisdictions to pivot the existing staff who are currently funded under the PHSA to the mission that matters most. It turns hands tied into helping hands within communities across the nation.

It also reduced reliance on the federal government. Communities best know their needs and this authority directly supports such efforts at low to no cost. Staff are already on the ground and have demonstrated the ability to quickly pivot under this authority to mitigate the impact of a public health emergency.

Congress included clear guardrails for use of this authority, and we appreciate the check and balance. For example, reassignments must be voluntary. They must occur within the geographic footprint of the declared emergency. Any reassignment beyond 30 days must be reauthorized. And importantly, the HHS Secretary must provide notice to Congress upon approval of an initial request or any extension. Flexibility and accountability exist side by side.

Streamlining Disaster Response

The expansion of PAHPA’s authorities reflects a broader principle that the Trump Administration has emphasized: disaster response works best when states are empowered to act. The threats facing state and local partners are not diminishing. Healthcare systems continue to operate under strain. Emerging biological threats require rapid coordination across jurisdictions. In that environment, workforce flexibility is not a luxury: It’s a necessity.

Over time, we’ve strengthened PAHPA to guarantee the authorities we need to respond proportionately in an emergency. We’ve used these authorities to empower state and local leaders so they can pivot their workforce quickly when conditions change.

Congress included a sunset date of September 2023 for this authority in the 2019 PAHPA reauthorization. The goal was to determine utilization of the authority. Every year since September 2023, the authority has been extended incrementally via funding bills.

Bottom line, temporary reassignment of personnel during disasters will give states the much-needed flexibility to move quickly and save lives when the next disaster strikes. History tells us that this authority is lifesaving. This is just one critical authority that ensures states have the flexibility they need to save more lives in the future.

CISA CyberSecurity Advisory #StopRansomware: Black Basta

This joint CSA to provides information on Black Basta, a ransomware variant whose actors have encrypted and stolen data from at least 12 out of 16 critical infrastructure sectors, including the Healthcare and Public Health (HPH) Sector.

Resource Type

CISA Alert: CISA and Partners Release Advisory on Black BASTA Ransomware

CISA, in partnership with the FBI, HHS, and the Multi-State Information Sharing and Analysis Center (MS-ISAC) released joint Cybersecurity Advisory (CSA) #StopRansomware: Black Basta to provide cybersecurity defenders tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) used by known Black Basta ransomware affiliates and identified through FBI investigations and third-party reporting.

Resource Type

ASPR Invests $15M to Secure First U.S. Source of Critical Influenza Drug Component, Reducing Reliance on Foreign Resources

FOR IMMEDIATE RELEASE
Contact ASPR Press Office

ASPRMedia@hhs.gov
aspr.hhs.gov/newsroom
X: @ASPRgov

ASPR Invests $15M to Secure First U.S. Source of Critical Influenza Drug Component, Reducing Reliance on Foreign Resources

The Administration for Strategic Preparedness and Response (ASPR), part of the U.S. Department of Health and Human Services, today announced a $15 million investment focused on solving the frequent shortage of Oseltamivir, a key starting material in Tamiflu. This funding is part of a broader set of actions by ASPR leveraging HHS designated Defense Production Act (DPA) Title III authorities to strengthen and protect the U.S. public health supply chain, a key component of national security.

Under the agreement, Manus Bio Inc., a private company in Waltham, Massachusetts, and a leader in scaling bio-alternatives, will expand its facilities in Augusta, Georgia, to produce Shikimic Acid. Using advanced biomanufacturing—including cell factory development, fermentation, and downstream processing—Manus will help strengthen the domestic supply chain for generic antiviral medicines.

“This investment supports modern, flexible manufacturing approaches that can scale more easily and lower production costs,” said John Knox, ASPR’s Principal Deputy Assistant Secretary for Preparedness and Response. “By enabling domestic production of Shikimic Acid – which is currently sourced entirely from China—we are reducing foreign dependence, supporting local job creation, and helping ensure reliable access to critical flu treatments, especially during times of shortage and national need.”

This agreement includes the preparation of any required data for the U.S. Food and Drug Administration (FDA) to assess drug applications from pharmaceutical manufacturers seeking to use Manus as a supplier.

ASPR’s DPA Title III program targets investments that create, maintain, protect, expand, or restore domestic industrial base capabilities that are critical to preparing for and responding to current and future national emergencies. This award marks Manus’ second DPA investment in biomanufacturing. Its first, awarded in December 2024, supported production of Artemisinin, a key starting material for Artesunate, an essential anti-malaria therapy.

Like the first, this award was made through the Biopharmaceutical Manufacturing Preparedness Consortium (BioMaP-Consortium), managed by Advanced Technologies International under an Other Transaction Authority agreement with ASPR’s Biomedical Advanced Research and Development Authority.

 


# # #

Plan: Version 2 of the National Cybersecurity Strategy Implementation Plan

Version 2 of the National Cybersecurity Strategy Implementation Plan (NCSIP)outlines actions the Federal Government is taking to improve U.S. National Cybersecurity posture. This updated roadmap describes 100 high-impact Federal initiatives, each intended to substantively increase our collective digital security and systemic resilience.

Resource Type

Fact Sheet: Version 2 of the National Cybersecurity Strategy Implementation Plan

This next phase of the NCSIP follows the progress to date and displays the Administration's commitment to transparency and accountability as the National Cybersecurity Strategy is implemented.Highlights of the Version 2 of the National Cybersecurity Strategy Implementation Plan (NCSIP) are included in this fact sheet.

Resource Type

HPH Cybersecurity Performance Goals (CPG)

These CPGs are a voluntary subset of cybersecurity practices that healthcare organizations, and healthcare delivery organizations in particular, can prioritize to strengthen cyber preparedness, improve cyber resiliency, and ultimately protect patient health information and safety.

Resource Type

Health Care and Public Health Sector Cybersecurity Framework Implementation Guide

Developed to help organizations establish a strong cybersecurity program or validate the effectiveness of an existing program, this guide helps organizations map their existing program to the NIST Cybersecurity Framework, identify improvements, and communicate results. This guide was developed to incorporate and align with processes and tools currently in use or under consideration.

Resource Type
Subscribe to