DEKRA Cybersecurity
What does NIS2 mean for your healthcare organization? Learn about key requirements, risks, and stand
DEKRA Cybersecurity
What does NIS2 mean for your healthcare organization? Learn about key requirements, risks, and stand
NIS2 in healthcare
Strengthen your cybersecurity
In the healthcare sector—which includes both healthcare institutions and the developers and suppliers of medical equipment—digitalization is irreversible: from electronic health records to smart medical devices and complex supply chains. This development brings significant benefits, but also growing cyber risks. The European NIS2 Directive (Network and Information Systems Directive 2) aims to significantly enhance the cybersecurity of organizations that provide essential services. DEKRA offers various independent services to help your organization comply with the NIS2 Directive.
What is NIS2?
What exactly is NIS2? NIS2 (Network and Information Systems Directive) is a European cybersecurity regulation and the successor to the original NIS regulation, which was introduced in 2016. This regulation aims to enhance the security of network and information systems within the EU, particularly for organizations that provide critical services such as energy, transportation, and healthcare.
NEN 7510, ISO 27001, and IEC 62443 as the basis for NIS2
For healthcare institutions (where NEN 7510 applies), improving cybersecurity means, in concrete terms: securing not only their own IT environment, but also patient data and medical equipment; establishing clear incident reporting processes; conducting risk assessments; ensuring continuous monitoring; and providing accountability at the executive level. This requires an action plan: first, gain insight; then take action; and finally, clearly document how everything works.
For developers and suppliers of medical devices (subject to IEC 62443 and ISO 27001), cybersecurity goes beyond product design. It includes secure integration with healthcare networks, trusted communication with partners, and continuous risk management. Organizations must also ensure ongoing monitoring of product safety and clear accountability at the management level. Both NEN 7510 for healthcare institutions and ISO 27001 and IEC 62443 for developers and suppliers of medical devices provide a solid and versatile foundation for compliance with the NIS2 Directive.
Healthcare organizations handle large amounts of sensitive data (such as patient information), operate in complex IT environments, and rely on networks of service providers. The NIS2 Directive requires healthcare organizations to:
- may fall under the definition of “essential entity,” which means that audits, inspections, and enforcement actions are possible.
- be required to conduct a comprehensive risk assessment: not only of their own systems, but also of those of suppliers and supply chain partners.
- involve administrative liability: the board or management shares responsibility for cybersecurity.
- are subject to mandatory reporting: cyber incidents that compromise the continuity or integrity of systems must be reported immediately.
The healthcare sector is therefore vulnerable in several ways. It is therefore not an option to wait until the NIS2 Directive comes into full effect in the near future (2026); taking action now is the way to go.
What you need to address as a healthcare organization
For example, if your organization uses network or information systems that process client data, works with external IT service providers, or offers medical equipment, there is a good chance that NIS2 applies to you. The key considerations in that case are:
- Conduct a risk analysis that takes into account IT, OT, and the supply chain.
- Developing technical, organizational, and physical measures based on current vulnerabilities.
- Establish an incident response and reporting process to ensure compliance with reporting requirements.
- Integrating supplier and supply chain management: your partners must meet the standards, and you must document this in a verifiable manner.
Why DEKRA?
At DEKRA, we combine our knowledge of the healthcare sector with expertise in (cyber) security standards and certification. We offer healthcare institutions a step-by-step certification process.
NIS2 in the healthcare sector calls for action
It’s wise to get started now. The sooner you prepare thoroughly for NIS2, the better you’ll be able to manage risks—and the stronger your position will be within supply chains and with regulators. Schedule a no-obligation consultation with one of our specialists today.
3 Results
May 19, 2026Cyber Security
ISO 27001 and NIS2
What are the differences and similarities? And can you combine NIS2 and ISO 27001? Learn more about these cybersecurity standards here
View article
Oct 28, 2024Digital & Product Solutions
NIS2 requirements
What is NIS2? And what are NIS2 requirements for cybersecurity? Read all about the directive here
View article
Oct 01, 2024Digital & Product Solutions / Cyber Security
NIS2 and IEC 62443
NIS2 & IEC 62443: The two critical pillars for cybersecurity and cyber resilience. Find out more here.
View article