These guidelines provide practical recommendations for integrating cybersecurity requirements into procurement processes in hospitals and healthcare organisations. Covering the entire procurement lifecycle, they support the identification and mitigation of cybersecurity risks, the definition of security requirements for suppliers, and the assessment of supplier-provided information. The guidelines also address alignment with relevant EU regulatory frameworks, including NIS2, GDPR, medical device regulations and the European Health Data Space Regulation.
Operational and Compliance Training
Access a wealth of resources including articles, whitepapers, tools, and guides to support your learning.
Category
Type
More
Difficulty Level
- Risk Management
EU ICT Supply Chain Security Toolbox
- Published date:
- Author: NIS Cooperation Group, with the European Commission and ENISA
The EU ICT Supply Chain Security Toolbox provides a common approach for identifying, assessing and mitigating cybersecurity risks across ICT supply chains. It outlines key risk scenarios and corresponding mitigation measures, including measures to reduce dependencies on high-risk suppliers. The Toolbox is complemented by dedicated risk assessments for connected and automated vehicles and detection equipment, providing practical guidance for strengthening ICT supply-chain resilience across the EU.
- Risk Management
Cybersecurity Guide for Businesses: 10 Practical Steps
- Published date:
- Author: SEV – Hellenic Federation of Enterprises (BSE)
The BSE Cybersecurity Guide provides businesses with ten practical steps for strengthening cybersecurity and improving resilience against digital threats. It covers risk assessment, cybersecurity governance and planning, protection of systems and data, employee awareness, business continuity, incident response, standards and certification, cyber insurance, and supply-chain security. The guide supports organisations, particularly SMEs, in systematically managing cyber risks, protecting business operations and developing a stronger cybersecurity culture.
- Risk Management
Cybersecurity Risk Management Standards and Methodologies
- Published date:
- Author: European Union Agency for Cybersecurity (ENISA)
This publication provides an overview of established standards addressing cybersecurity and information security risk management. It examines relevant risk management approaches and presents methodologies and tools that organisations can use to implement or conform with these standards. The resource can support organisations in selecting appropriate frameworks and developing structured approaches to identifying, assessing and managing cybersecurity risks.
- Risk Management
SME Cyber Resilience and CRA Maturity Assessment Model
- Published date:
- Author: European Union Agency for Cybersecurity (ENISA)
This ENISA maturity assessment model helps SMEs evaluate and strengthen their cyber resilience and product security practices in line with the Cyber Resilience Act (CRA). Primarily aimed at manufacturers of products with digital elements, the model provides a structured approach for assessing cybersecurity maturity and identifying areas for improvement. It can also support integrators, service providers and other organisations involved in the digital product lifecycle. An accompanying Excel-based assessment tool enables practical application of the model.
- Risk Management
ENISA Cybersecurity Maturity Assessment for SMEs
- Published date:
- Author: European Union Agency for Cybersecurity (ENISA)
The ENISA Cybersecurity Maturity Assessment for SMEs is an online self-assessment tool that helps small and medium-sized enterprises evaluate their cybersecurity maturity across people, technology, and organisational processes. Based on the assessment results, the tool provides a tailored action plan with practical recommendations to improve cyber resilience, strengthen security practices, and support the management of cybersecurity risks.
- Compliance Standards
Technical Competence Requirements for Cyber Resilience Act (CRA) Notified Bodies
- Published date:
- Author: European Union Agency for Cybersecurity (ENISA)
This ENISA publication outlines the high-level technical competence requirements for Conformity Assessment Bodies (CABs) seeking designation as Notified Bodies under the EU Cyber Resilience Act (CRA). The document focuses on the knowledge, experience, training, and auditing capabilities required for personnel involved in evaluating the cybersecurity conformity of products. It provides guidance for developing qualified assessment teams and supports the consistent implementation of CRA certification and conformity assessment processes across the European Union.
- Risk Management
ENISA NIS360: Maturity and Criticality Assessment of NIS2 Sectors
- Published date:
- Author: European Union Agency for Cybersecurity (ENISA)
The ENISA NIS360 is an assessment framework that evaluates the maturity and criticality of sectors covered by the NIS2 Directive. Drawing on data from national authorities, organisations operating in critical sectors, and EU-level sources, the tool provides both a comparative overview and detailed sector-specific analysis. It helps Member States, regulators, and stakeholders identify cybersecurity capability gaps, benchmark sector readiness, and prioritise investments and resources to strengthen cyber resilience across critical sectors.
- Compliance Standards
EU AI Act Service Desk and Single Information Platform
- Published date:
- Author: European Commission
The EU AI Act Service Desk and Single Information Platform provide practical tools and guidance to help organisations understand and comply with the European Union AI Act. The platform includes the AI Act Explorer, Compliance Checker, implementation guidance, FAQs, and support services designed to assist stakeholders in assessing obligations related to trustworthy and high-risk AI systems. It supports startups, SMEs, developers, and deployers in navigating AI governance, compliance, and risk management requirements across the EU.
- Compliance Standards
Guidelines for Providers and Deployers of High-Risk AI Systems under the EU AI Act
- Published date:
- Author: European Commission
These European Commission guidelines support providers and deployers in understanding and classifying high-risk AI systems under the EU AI Act. The document explains key obligations, risk categories, and practical implementation considerations, including examples across sectors such as biometrics, critical infrastructure, education, employment, and migration. The guidelines aim to facilitate compliance, improve trustworthy AI deployment, and support the secure and responsible use of AI systems across the European Union.