These guidelines provide practical recommendations for integrating cybersecurity requirements into procurement processes in hospitals and healthcare organisations. Covering the entire procurement lifecycle, they support the identification and mitigation of cybersecurity risks, the definition of security requirements for suppliers, and the assessment of supplier-provided information. The guidelines also address alignment with relevant EU regulatory frameworks, including NIS2, GDPR, medical device regulations and the European Health Data Space Regulation.
Risk Management
Access a wealth of resources including articles, whitepapers, tools, and guides to support your learning.
Category
Type
More
Difficulty Level
- Risk Management
EU ICT Supply Chain Security Toolbox
- Published date:
- Author: NIS Cooperation Group, with the European Commission and ENISA
The EU ICT Supply Chain Security Toolbox provides a common approach for identifying, assessing and mitigating cybersecurity risks across ICT supply chains. It outlines key risk scenarios and corresponding mitigation measures, including measures to reduce dependencies on high-risk suppliers. The Toolbox is complemented by dedicated risk assessments for connected and automated vehicles and detection equipment, providing practical guidance for strengthening ICT supply-chain resilience across the EU.
- Risk Management
Cybersecurity Guide for Businesses: 10 Practical Steps
- Published date:
- Author: SEV – Hellenic Federation of Enterprises (BSE)
The BSE Cybersecurity Guide provides businesses with ten practical steps for strengthening cybersecurity and improving resilience against digital threats. It covers risk assessment, cybersecurity governance and planning, protection of systems and data, employee awareness, business continuity, incident response, standards and certification, cyber insurance, and supply-chain security. The guide supports organisations, particularly SMEs, in systematically managing cyber risks, protecting business operations and developing a stronger cybersecurity culture.
- Risk Management
Cybersecurity Risk Management Standards and Methodologies
- Published date:
- Author: European Union Agency for Cybersecurity (ENISA)
This publication provides an overview of established standards addressing cybersecurity and information security risk management. It examines relevant risk management approaches and presents methodologies and tools that organisations can use to implement or conform with these standards. The resource can support organisations in selecting appropriate frameworks and developing structured approaches to identifying, assessing and managing cybersecurity risks.
- Risk Management
SME Cyber Resilience and CRA Maturity Assessment Model
- Published date:
- Author: European Union Agency for Cybersecurity (ENISA)
This ENISA maturity assessment model helps SMEs evaluate and strengthen their cyber resilience and product security practices in line with the Cyber Resilience Act (CRA). Primarily aimed at manufacturers of products with digital elements, the model provides a structured approach for assessing cybersecurity maturity and identifying areas for improvement. It can also support integrators, service providers and other organisations involved in the digital product lifecycle. An accompanying Excel-based assessment tool enables practical application of the model.
- Risk Management
ENISA Cybersecurity Maturity Assessment for SMEs
- Published date:
- Author: European Union Agency for Cybersecurity (ENISA)
The ENISA Cybersecurity Maturity Assessment for SMEs is an online self-assessment tool that helps small and medium-sized enterprises evaluate their cybersecurity maturity across people, technology, and organisational processes. Based on the assessment results, the tool provides a tailored action plan with practical recommendations to improve cyber resilience, strengthen security practices, and support the management of cybersecurity risks.
- Risk Management
ENISA NIS360: Maturity and Criticality Assessment of NIS2 Sectors
- Published date:
- Author: European Union Agency for Cybersecurity (ENISA)
The ENISA NIS360 is an assessment framework that evaluates the maturity and criticality of sectors covered by the NIS2 Directive. Drawing on data from national authorities, organisations operating in critical sectors, and EU-level sources, the tool provides both a comparative overview and detailed sector-specific analysis. It helps Member States, regulators, and stakeholders identify cybersecurity capability gaps, benchmark sector readiness, and prioritise investments and resources to strengthen cyber resilience across critical sectors.
- Risk Management
Protecting Data from Ransomware and Data Loss (NIST NCCoE, 2020)
- Published date:
- Author: National Institute of Standards and Technology
This NIST NCCoE guide provides practical recommendations to help Managed Service Providers (MSPs) design, maintain, and test backup files to reduce the impact of ransomware and other data loss events (e.g., hardware failure, accidental or malicious deletion). It supports implementation of the NIST Cybersecurity Framework subcategory PR.IP-4 by outlining considerations for backup planning, selecting backup services/products, ensuring backup availability and integrity, and strengthening disaster recovery readiness. The guidance is adaptable—MSPs can apply only the recommendations relevant to their operational context.
- Risk Management
Guide for Conducting Risk Assessments
- Published date:
- Author: National Institute of Standards and Technology (NIST)
NIST Special Publication 800-30 Rev. 1 provides structured guidance for conducting cybersecurity risk assessments across information systems and organizations. It supports decision-making at all levels of the risk management hierarchy by outlining methodologies to identify threats, vulnerabilities, impacts, and residual risks. The guide complements NIST SP 800-39 and serves as a foundational reference for integrating risk assessment into enterprise-wide risk management and security control selection.
- Risk Management
#StopRansomware Guide: Prevention and Response Best Practices
- Published date:
- Author: Cybersecurity and Infrastructure Security Agency (CISA)
This guide from CISA, MS-ISAC, NSA, and the FBI provides actionable best practices for preventing and responding to ransomware and data extortion attacks. It includes two core parts: (1) Prevention guidance based on common attack vectors, including credential compromise and social engineering, and (2) A detailed response checklist with detection and threat hunting steps. The guide aligns recommendations with CISA’s Cross-Sector Cybersecurity Performance Goals and highlights the evolving tactics of ransomware actors, including double extortion. Ideal for IT and cybersecurity professionals across sectors.