An IT failure hits the electronic patient record. Wards switch to paper, planned care is rescheduled, neighbouring hospitals absorb the load. After days everything is back and the notification has been filed. Three months later the regulator asks: "what did that outage change in your organisation?" The answer sits scattered across inboxes, an evaluation report and the crisis team's minutes. You did learn — you just cannot show it.
The same directives, your regulator
NIS2 and CER apply to essential and critical entities in this sector; supervision lies with the competent authority designated for it. The annex includes healthcare providers, EU reference laboratories, pharmaceutical development and production, and manufacturers of critical medical devices.
Per anchor: what the directive asks, and what is ready for it.
Go to the law →One yardstick for exercise and real response, recurring threads that get followed through, and readiness from exercise and response data alike.
Go to the approach →