In recent years, the average cost of healthcare-related data breaches increased from approximately US$7 million in 2020 to over US$9 million in 2021. Moreover, breaches in healthcare have been consistently more costly than in other sectors for 11 consecutive years. With the frequency and costs of cyberattacks expected to rise, healthcare organizations must carefully plan for and identify strategies to mitigate cyber-related risks. This paper provides practical guidance for boards, senior leaders and risk managers in the development and implementation of organization-specific cybersecurity measures, with a focus on the identification, mitigation and management of risks.