What do you do when business unit leaders push back on your SOC’s recommendations?

From business perspective, list the risks of non-compliance/not making necessary investments  in layperson terms and the ROI of any required investments. Using Poneman 2022 as your reference, quantify the risk in terms of lost revenue ($4.35M average) and the impacts financially on margins, earnings, stock price, bonuses, etc.  Present a risk reduction business case vs. what may be perceived as overbuilding/overreach.   

Ensure the risk is clearly defined in business terms, the likely loss of business, reputational damage etc.

Listen to their concerns and discuss them.

Remind them of their responsibility to keep patient data safe and secure, and then reiterate the COST in dollars and to reputation of any breach, not to mention how it reflects on them as the leaders of our organization.  Regulatory consequences for us (HIPAA, GDPR) are severe.

Listen. Then explain it is a shared responsibility. Appeal to corporate governance that we are all in this together.