NIS2 for healthcare: a fixed-price path to compliance
Diagnostic, action plan, security accreditation and PASSI audit for healthcare organisations and software publishers within the scope of the NIS2 directive.
The European NIS2 directive extends cybersecurity obligations to a large number of healthcare players: care facilities, laboratories, medical device manufacturers, as well as software publishers and hosting providers whose services are essential to care. Governance, risk management, supply chain security and incident reporting become obligations supervised by ANSSI.
Dipole Security, PASSI qualified across all scopes and specialised in healthcare, offers a four-step path, each step at a fixed price, from scoping to evidence of compliance.
A four-step path
Each step delivers a standalone deliverable; you move forward at your own pace.
NIS2 entry diagnostic
Scoping and entity status, interviews with your teams, gap analysis against the requirements and debrief to management.
Prioritised action plan
Risk-based roadmap, identification of high-impact quick wins and budget estimate for each workstream.
Security accreditation
EBIOS Risk Manager risk analysis adapted to the healthcare context, accreditation file and support for the accreditation board.
PASSI audit
Organisational audit, configuration audit and external penetration test carried out by PASSI-qualified auditors.
Our NIS2 healthcare packages
Prices excluding VAT. Each step can be ordered separately.
NIS2 healthcare diagnostic
€3,600 excl. VATFixed price
- 4 days of work
- Scoping
- Gap analysis report
- Debrief to management
Diagnostic + Action plan package
€5,900 excl. VATFixed price
- Full NIS2 healthcare diagnostic
- Prioritised and costed roadmap
- High-impact quick wins
- Budget estimate
Security accreditation
On quoteIndicative: from €7,200 excl. VAT
- EBIOS Risk Manager risk analysis
- Accreditation file
- Accreditation board support
PASSI audit
On quoteIndicative: from €7,200 excl. VAT
- Organisational audit
- Configuration audit
- External penetration test
Accreditation and audit prices depend on the number of sites, the presence of biomedical or industrial systems, how health data is hosted and the initial maturity level.
Frequently asked questions
Is my organisation subject to NIS2?
Directive (EU) 2022/2555 lists healthcare among the sectors of high criticality: healthcare providers, reference laboratories, research and manufacturing of medicinal products, medical device manufacturers. Software publishers and hosting providers may also be in scope as digital or managed ICT service providers.
In principle, it targets organisations with at least 50 employees, or whose turnover and balance sheet both exceed €10 million. The diagnostic starts with this scoping.
What is the difference between essential and important entities?
The status depends on sector and size. Essential entities are subject to ex ante supervision and higher penalties; important entities to ex post supervision. The security measures required are similar in both cases.
How does it relate to accreditation, HDS and Ségur?
NIS2 does not replace existing French healthcare frameworks: it adds to them. The diagnostic reuses what is already in place — HDS certification, Ségur requirements, existing accreditations — to address only the real gaps.
Why a PASSI-qualified audit?
A PASSI audit is carried out under ANSSI's framework by qualified auditors. It provides recognised evidence that security measures are effective, useful both for accreditation and with the supervisory authority.
Start with a NIS2 healthcare diagnostic
In four days, find out whether you are in scope, where you stand and where to start.