## 1 Introduction  
Cybersecurity and privacy incidents are a growing threat to the healthcare industry in general, and hospitals in particular [1]. The healthcare industry has lagged behind other industries in protecting its main stakeholders (e.g., care staff and patients), and now hospitals must invest considerable capital and effort in protecting their IT systems [2]. However, moving to more protected and resilient digital infrastructures in healthcare is a challenge because hospitals are extraordinary technology-saturated, complex organizations with high end-point complexity, internal politics, and regulatory pressures. Therefore, healthcare organizations of all types looking to grow and achieve their financial, quality, service and compliance performance objectives must understand and account for the capabilities, drivers, strategies, and challenges of other ecosystems such as cybersecurity and information privacy. Hence, as cybersecurity and privacy become more of a priority for hospitals, it is essential a holistically integration in the different processes, components and stages influencing the healthcare ecosystem. One relevant aspect to consider regarding cybersecurity and privacy risks are healthcare point-of-care (POC) systems which have been widely used in hospitals in order to provide innovative solutions to medical professionals. Where, POC systems provide an overview of the patients' conditions in a way that makes it easier for professionals to respond on time and prevent critical situations. POC systems are platforms that incorporate devices and applications in order to collect, process and visualize data. Using large amounts of data, which contain personal health information and sensitive medical data, communicated across various POC systems, backend analytical platforms, user workstations and smartphones, it becomes evident that there are multiple threats that may cause data leakages or breach incidents. Naturally, these platforms create and expanded attack surface, which may be challenging to identify and address. Hospitals and care centers need to address these threats by efficiently assessing the associated risks and mitigate them with the proper cybersecurity and privacy safeguards. Namely, POC systems can be categorized in three classes according to their usage model [3] (i) for testing and diagnostic applications (e.g., medical devices), (ii) for patient monitoring (e.g., smartphone apps) and (iii) for as interfacing with other devices (e.g., web-based services and integration servers). Hence, considering the latter classes, some common associated threats to POC systems encompass legacy operating systems and software, lack of timely software updates and patches, medical devices not having basic security features, insecure implementation of web-services, lack of awareness of cybersecurity and privacy issues and limited power and resources [4], among others. Typically, these threats can be exploited by several common attacks (e.g., cross-site scripting, Structured Query Language (SQL) or Extensible Markup Language (XML) injection, client-side attacks, malware and denial-of-service). Generally, risk is defined as the combined probability of an unwanted event and its level of impact. It is described as a function of the probability that a given source of threat exerts a potential vulnerability and the consequent impact of this adverse event on the organization [5]. Cybersecurity risk, also known as information technology risk, is the new management challenge of the third millennium; it affects the information and technology assets of organizations. On one hand, cybersecurity risk is defined in [6] as \"operational risks to information and technology assets that have consequences affecting the confidentiality, availability, or integrity of information or information systems\".