Specialisation
Cybersecurity in healthcare
A hospital, clinic or laboratory cannot stop working, and the IT team is often just a few people. We help set up security so that it protects continuity of care and patient data instead of adding work for staff.
What sets this sector apart
- Continuity of care comes first. The emergency department, operating theatre, laboratory and pharmacy need fallback procedures for when a system is down.
- Dependence on suppliers. Suppliers of hospital information, medical records, imaging and laboratory systems often have remote access to the facility's network.
- A small IT team. The team that runs the systems should not manage their security alone, because then it controls itself.
- Personal accountability of the director. The head of the entity is responsible for decisions, budget and annual training.
How we help
Readiness review
In 2.5 days we establish the facility's status, the gaps and a 90-day plan that is ready to carry into the budget.
Medical system suppliers
A list of suppliers with remote access, contractual requirements and how to verify them.
Business continuity
Impact analysis and fallback procedures for clinical processes, tested in an exercise with your team.
Incidents
An incident handling and reporting procedure and an exercise with staff.
Training
Training for staff and management, and phishing tests.
Ongoing support
A person for security management without creating a new post.
See the readiness review, implementation and ongoing support.
Results
A specialist hospital had no full picture of its security before the new obligations. After the audit, management received a prioritised action plan ready to carry into the budget, and staff know what to do in the first hours of an incident.
In the ASCLEPIUS project, coordinated by IS Consulting, more than 1,000 employees were trained at six healthcare entities and the click rate in phishing tests fell from 11 to 3 percent. Meet the ASCLEPIUS project.
"We recommend IS Consulting as a competent advisory partner in assessing and building compliance with the KSC, cybersecurity audits, training and preparation for supervisory requirements."
Pharma and medicine distribution
Manufacturer, wholesaler and pharmacy form a chain in which a weakness in one link stops the supply of medicines. We help secure continuity of supply, medicine authenticity verification systems and data across that chain, in proportion to the organisation's scale.
One of the six ASCLEPIUS entities comes from the medicine supply chain. Within the project, more than 15 critical suppliers were assessed and around 20 hours of tabletop exercises were carried out. See our analysis of the CRA's impact on the healthcare supply chain.
Regulations
A hospital with at least 50 staff is, as a rule, subject to the Polish National Cybersecurity System (KSC) rules, and the obligations must be in place by 3 April 2027. Some entities in the medicine supply chain are covered as well. On top of that come the GDPR and supplier requirements. We treat them as the result of one security programme. See our approach to compliance.
Frequently asked questions
By setting the order. Urgent items are the director's decisions, suppliers with remote access, backups, fallback procedures and incident handling. Certification and new tools can wait.
No. The law allows incident handling to be entrusted to an external security service provider. We do not provide such services ourselves, we help set the requirements and the oversight of the provider.
Yes, according to guidance from the Polish Ministry of Digital Affairs.
Yes. We work with hospitals, clinics, laboratories and diagnostics providers, public and private.
With a readiness review. We first check whether and which regulations apply to you, and the list of gaps and the 90-day plan show what to put in order first.
Let us talk about the security of your organisation
You do not need to be ready for a large project. A conversation about where you are and what the law requires of you is enough. We will help you plan realistic, workable steps.
- contact@isconsulting.pl
- Address
- ul. Żelazna 51/53, 00-841 Warszawa, Poland