The networking of medical devices or systems in a hospital network is the foundation for modern medical diagnostics and therapy. This, however, makes possible numerous hazards that could lead to risks for patients, clinical processes or data and information. The aim of the work was to develop a catalogue of measures and indicators for the effective support of the IT risk management process in a health facility. Through a qualitative and quantitative Delphi study among 21 experts, it was possible to identify an initial 51 practice-relevant measures of IT risk management that a hospital should implement. Additionally, 27 indicators were defined which can be used to measure the impact of these measures. Of the 51 measures, 35 were seen as especially important, particularly organizational measures. Of the 27 indicators, six were seen as especially important, particularly indicators to measure networking effectiveness. The study also investigated the impact of the measures on the indicators. A case study is planned to investigate the practicability of the identified measures and indicators.