Introduction
Health Network Inc. is a (fictional) health services organization that has over 600 employees throughout the organization and generates $500 million USD in annual revenue. The organization has three locations and three production data centers that provide high availability across the organization’s products. Health Network has three main products: HNetExchange, HNetPay, and HNetConnect.

• HNetExchange service handles secure electronic medical messages that originate from its customers, such as large hospitals, which are then routed to receiving customers such as clinics. HNetExchange is the main source of revenue for this organization.
• HNetPay is a web portal, hosted at Health Network production sites, that accepts various forms of payments and interacts with credit-card processing organizations.
• HNetConnect is an online directory that lists doctors, clinics, and other medical facilities to allow Health Network customers to find the right type of care at the right locations. It contains doctors’ personal information, work addresses, medical certifications, and types of services that the doctors and clinics offer.

Information systems, which provide critical support for organizational missions, are a key area of risk management. Having a formal risk management plan is the foundation of effective risk management. Health Network’s Risk Management Plan is out of date and a new risk management plan must be developed. The purpose of developing a Risk Management Plan for Health Network Inc. is to update the old Risk Management Plan, bring the organization within compliance and to develop an effective risk management process.