Cybersecurity · November 2026
NIS2 and healthcare: where to start
Healthcare is one of the critical sectors covered by the NIS2 directive. First steps for the providers, laboratories and manufacturers concerned.
Who is concerned
Care providers, laboratories, medical device manufacturers and pharmaceutical research players may fall within scope depending on their size and activity. An initial scoping tells you whether you are an “essential” or an “important” entity.
What the directive requires
- Cyber risk management: policies, vulnerability management, business continuity, supply-chain security.
- Incident reporting: early warning within 24 hours, notification within 72 hours, final report within one month.
- Governance: management approves the measures and is accountable for them.
Where to start
A maturity assessment, a map of critical systems and a crisis exercise give a prioritised action plan. The conditions of transposition into French law should be followed closely.
General information, not legal advice.