Essential entity with proactive BSI supervision
Annex I means the highest sanction tier and active BSI supervision. Cyber incidents touching patient data carry double reporting obligations: BSI under NIS-2 plus data-protection authority under GDPR.
Annex I of the German NIS-2 implementation act covers healthcare facilities, laboratories, pharma manufacturers and medical device makers as essential entities. MDR (medical device regulation) and GDPR with special patient-data protection add up. The Cybervize platform covers ISMS, BCM and supplier risk in one solution.
Book the NIS-2 risk check
Hospitals with 30,000+ inpatient cases per year qualify as KRITIS operators and fall under NIS-2 Annex I as „essential entity"; medical-device manufacturers and health-IT providers fall under Annex I or II depending on activity, plus MDR cybersecurity requirements. Four consequences of this classification for hospitals, labs and parts of the pharma sector. Sector alone is not enough: pharma manufacturers and medical-device manufacturers fall under different rule sets (NIS-2 Annex I/II, MDR, AMG); the actual classification depends on activity and size thresholds. The legally binding evaluation remains a matter for specialised counsel.
Annex I means the highest sanction tier and active BSI supervision. Cyber incidents touching patient data carry double reporting obligations: BSI under NIS-2 plus data-protection authority under GDPR.
Medical devices with IT interfaces (imaging, lab equipment, connected implants) fall under MDR plus NIS-2. Manufacturers additionally have post-market surveillance obligations. Hospitals carry user obligations.
Hospitals with more than 30,000 inpatient cases per year fall under the German KRITIS regulation. Obligations under BSI standards and security audits add up.
Health data are special categories under Art. 9 GDPR. Processing requires specific legal grounds. A cyber incident with a data breach triggers tightened reporting obligations and higher GDPR sanction risks.
Five NIS-2 minimum measures per §30, translated for healthcare practice.
Risk register separating office IT, clinical IT (HIS, RIS, PACS) and medical devices but tying them together. Patient safety risks from cyber incidents classified separately.
Supplier inventory with medical-device manufacturers, MDR status, cybersecurity bill of materials (CBOM) for connected devices, agreements on patches and vulnerability disclosure.
Patient data encrypted at rest and in transit, key management per §75c SGB V (sector requirements for healthcare), clinical backups in a dedicated security zone.
Incident response plan distinguishing pure cyber incidents from incidents with patient safety impact. Escalation to BSI, data-protection authority, hospital supervisor. MDR manufacturers additionally notify BfArM.
BCM plan with patient safety as the top priority. Fall-back processes for HIS outage (paper records, manual workflow), emergency care during ransomware. Restart sequence documented.
The Cybervize platform covers ISMS, BCM, assessment and supplier risk in one solution. For healthcare, KRITIS reporting and medical-device risk modules are additionally relevant.
Free 30-minute initial call with an indicative NIS-2 classification, top-5 gaps and a path recommendation.
Learn more Service 02ISMS, compliance and evidence from a single platform. Multi-entity, multi-country, AI-supported.
Learn more Service 03Platform plus permanent CISO function. For organisations without an in-house CISO.
Learn more Service 04Gap assessment, roadmap, implementation via the platform. Fixed price from 4,500 euros.
Learn moreSelf-check available
Free, no signup, around 5 minutes. Detailed evaluation by email if desired.
Industry experience in healthcare and KRITIS from 25 years of ISMS practice at PwC, Deloitte and KPMG. Hospital mandates and medical-device manufacturers part of the methodology. ISO 27001 Lead Auditor since 2006.
Free risk check with indicative NIS-2 classification, KRITIS threshold indicator and path recommendation. Ideally with IT leadership or data protection officer plus management board present.
Book the NIS-2 risk checkMemberships, programmes and partnerships
Structured NIS-2 compliance: gap assessment, roadmap, and implementation in 12 weeks.
Learn moreFree self-check: where do you stand on the ten §30 BSIG measures? 30 questions, instant traffic light.
Learn moreThe ten regulated sectors the Cybervize platform runs in.
Learn moreMany companies treat NIS2 as a tick-box exercise. But compliance is not the same as resilience. The Cross-Border Cybersecurity Tour #2 in Saarbrücken made it clear: a functioning security operation outweighs any tool collection.
70% of SMEs treat NIS2 as a compliance checkbox. But organizations that see it as a strategic lever can turn regulatory requirements into operational excellence and genuine resilience.