01 ·
Clinical continuity
Care does not stop. Fortgale MDR is designed to contain without shutting down critical clinical systems. We work alongside healthcare IT staff.
Cybersecurity for healthcare organisations.
Healthcare organisations are NIS2 essential entities. When an incident halts a department, three clocks run together: clinical triage, the national CSIRT notification and the Data Protection Authority notification. Fortgale handles the three lines in parallel.
Regulatory references
NIS2 transposition
GDPR · art. 33-34
MDR · Reg. EU 2017/745
ENISA · CSIRT
Technical scope
IoMT · DICOM · HL7
PACS / RIS
Active Directory
Veeam · backup
Why Fortgale for healthcare
Three constraints specific to the healthcare sector.
Healthcare is not just an industry with personal data: it is an essential service that cannot stop, with one of the most sensitive information assets (clinical data) under GDPR art. 9, and devices that stay in production for 10-15 years without patches.
02 ·
Dual CSIRT + DPA notification
When a data breach hits clinical data, both obligations trigger: national CSIRT (24h/72h/30d) and Data Protection Authority (72h). Fortgale prepares the two notifications in parallel.
03 ·
IoMT medical devices
PACS, RIS, monitors, infusion pumps are not patched like IT endpoints. Segmentation, OT-aware passive monitoring and vendor access control with MFA jump hosts.
CSIRT notification · healthcare
The three NIS2 deadlines for healthcare organisations.
When an incident hits a healthcare organisation qualified as essential entity, three time-bound obligations trigger toward the national CSIRT, layered with the GDPR notification to the Data Protection Authority. Fortgale prepares the technical documentation for all notifications in parallel.
24HOURS
CSIRT early warning
Organisation identification, incident description, systems involved, initial containment measures. National CSIRT portal.
NIS2 essential entities
72HOURS
CSIRT intermediate notice
Initial impact assessment, collected IoCs, containment measures activated. Same deadline for the DPA notification (GDPR art. 33).
Formal CSIRT + DPA notification
30DAYS
CSIRT final report
Root cause analysis, attack vector, definitive impact, corrective measures, improvement plan. Defensive documentation in case of sanction.
Formal closure
Proof · healthcare
Four numbers on the European healthcare landscape.
12 %
Ransomware attacks
against EU healthcare 2024
against EU healthcare 2024
94 %
European organisations
NIS2 essential entities
NIS2 essential entities
72 h
DPA notification
GDPR art. 33
GDPR art. 33
24·7
European SOC
for clinical continuity
for clinical continuity
Sector-specific threats
Four vectors that hit hospitals.
Ransomware
Encryption of clinical records
LockBit, BlackCat, Rhysida have hit European hospitals. Department halts, ambulance diversion, surgery postponement.
Data leak
Clinical data exfiltration
Double extortion with publication on leak sites of reports, anamnesis, clinical photographs. GDPR sanction and severe reputational damage.
BEC · fraud
Procurement fraud
Phishing on accounting and procurement offices. Diverted wire transfers on pharmaceutical supplies and devices.
IoMT
Medical device compromise
Known unpatched vulnerabilities on PACS, RIS, monitors. Pivot to clinical networks from exposed DICOM/HL7 brokers.
Related services
Three components for healthcare organisations.
European SOC
MDR 24·7
European SOC with senior team. MITRE ATT&CK-mapped detection, median containment ~11 min.
Discover MDR →Emergency
Incident Response
When the incident is in progress, Fortgale handles technical, communication, notification and recovery in a single flow.
Discover →Anticipation
Cyber Threat Intelligence
Proprietary feeds on actors active against European healthcare: LockBit, BlackCat, Rhysida, BlackSuit.
Discover CTI →FAQ · Healthcare
The most frequent questions of healthcare organisations.
In case of a data breach, how long do healthcare organisations have to notify the national CSIRT?
Healthcare organisations qualified as essential entities under NIS2 transposition must notify in three steps: early warning within 24 hours, intermediate notification within 72 hours, final report within 30 days. When the incident involves a personal-health-data breach, the Data Protection Authority must also be notified within 72 hours (GDPR art. 33). The two notifications are independent.
Which healthcare organisations are NIS2 essential entities?
Qualified as essential: public and accredited private hospitals, analysis and reference laboratories, manufacturers of critical medical devices, drug distributors, clinical research organisations. Qualification depends on sector and size (medium and large enterprises, with exceptions for critical entities). Smaller organisations may fall under important or remain out of scope, but GDPR always applies.
What to do in case of ransomware in a healthcare organisation?
Five parallel actions: (1) activate the clinical continuity plan to guarantee care; (2) isolate compromised systems without powering them off (to preserve RAM evidence); (3) notify the national CSIRT within 24 hours if NIS2 entity; (4) notify the DPA within 72 hours if personal data is involved; (5) start the technical incident response. Fortgale supports all five lines in parallel.
How are medical devices protected from cyber attacks?
Medical devices (PACS, RIS, monitors, infusion pumps, IoMT) can rarely be updated like IT endpoints. Protection relies on: dedicated network segmentation (isolated healthcare VLANs), OT-aware passive traffic monitoring, vendor access control with MFA jump hosts, firmware and CVE inventory, perimeter hardening (IoMT gateways, DICOM/HL7 brokers), compliance with the MDR Regulation (EU) 2017/745 for the lifecycle.
Are private healthcare organisations subject to the same obligations as public ones?
Yes. NIS2 applies indistinctly to public and private healthcare sectors above size thresholds. Accredited private organisations are often critical suppliers of public health systems and fall in the same essential entity categories. GDPR applies equally to both. The difference concerns only internal procedures for appointing the cybersecurity officer.
Clinical continuity · cybersecurity
Care does not stop. Even during an attack.
Fortgale supports public and private European healthcare organisations in protecting clinical data, medical devices and continuity of care. From 24·7 MDR to the dual CSIRT + DPA notification, in a single operational flow.