Meet us at the Startup area, and at our workshop on Wednesday 7 October, 4:30 pm. Grimaldi Forum, a ten-minute pitch.
Book the workshopOur Assises workshopBY INDUSTRY · HEALTHCARE
One RSSI for a GHT of several hospitals, biomedical equipment nobody can patch, and a chain of obligations with different portals: CERT Santé, the CNIL, the HDS contract, NIS2. Mindlapse gives that one person a posture that holds between two crises.
NIS2 · HDS and PGSSI-S · CERT Santé · Derogations that expire
Care functions · 4 Activities · 8 Risk links · 11 Supplier links · 6 Télémaintenance access on two critical activities · supplier not yet assessed
Emergency
télémaintenance · 3 risks
1 risk
Imaging
télémaintenance · 2 risks
1 supplier
Laboratory
2 risks · 1 supplier
1 supplier
Pharmacy
2 risks
1 supplier
A care pathway is the unit of risk; systems and suppliers hang off it. Governance records only: patient data never enters the platform.
THE SITUATION
Embedded software older than your youngest nurse, on a flat network, under a maintenance contract that forbids touching it.
The same person answers the ARS, the CNIL and the auditor, and runs the crisis cell when it comes.
The CERT Santé declaration, the CNIL at 72 hours, the HDS contractual chain, and NIS2 to ANSSI once the French law applies: the same incident, several forms.
The analyser has a maintenance contract, a vendor VPN and no line in any risk register.
WHO IS IN SCOPE
Healthcare providers are a NIS2 Annex I sector. In France, hospitals and hospital groups (GHT) are the entities most likely to be essential, smaller establishments important or out of scope by size, all of it once the French law applies. The sector also carries HDS certification for anyone hosting personal health data on behalf of a third party, the PGSSI-S referentials, the CaRE programme and mandatory incident reporting to CERT Santé. Medtech manufacturers answer to NIS2 Annex II and, for the devices it lists, to the AI Act.
Written for
WHAT MINDLAPSE CHANGES
Surface: Value Chain Map
Emergency, imaging, laboratory, pharmacy as functions, the clinical systems as the activities that carry them, and every risk, supplier and exception attached where care would stop. Not a device inventory.
Learn more
Surface: Derogation lane
The imaging workstation that must stay on its old system gets a derogation with compensating measures, a scored coverage and an expiry that reopens the decision.
Learn more
Surface: Supplier Hub
The software editor, the télémaintenance provider and the HDS host answer through a portal that costs them nothing, in the context of the activity they serve, and are re-assessed when an event touches them.
Learn more
Surface: Risk Register
The official feeds land every morning and are matched to the systems you declared; the advisory that concerns the laboratory system moves its risk and raises a finding.
Learn more
Surface: Cyber Incidents
The incident is qualified once; the cascade drafts the CERT Santé, CNIL and NIS2 notifications from the same record and logs them; your team files each on its portal.
Learn more
THE OBLIGATIONS MAP
EU rows first, the French specifics tagged; every "verifies" cell is a product claim at ledger level, no cell carries a date, and the sentence under the table is the site’s one dated source.
| Regulation | Obligation | What Mindlapse verifies | Surface |
|---|---|---|---|
| NIS2 | Art. 20 · accountability of the directeur, the directoire and the GHT governance | A verified posture in board-readable views: exposure by care activity against the appetite the directoire approved | Cyber Cockpit |
| NIS2 | Art. 21(2)(c) · continuity, backup and crisis management | Continuity controls with dated evidence; what cannot be fixed yet as a derogation with compensating measures and an expiry | Control Atlas |
| NIS2 | Art. 23 · incident reporting | One incident record, the cascade to the notification file, the log; your team files it | Cyber Incidents |
| GDPR | Art. 35 · DPIA where a clinical system is likely to entail a high risk | Privacy scoping at initiative intake and GDPR-related control sets in the atlas; the DPIA itself stays where you keep it | Security by Design |
| HDS FR | Hosting of personal health data on behalf of a third party | Your hosts and their sub-hosts assessed as critical suppliers, certificates as dated evidence, PGSSI-S mapped to the same control set; Mindlapse holds governance records only and claims no HDS status | Supplier Hub |
| CERT Santé FR | Mandatory declaration of significant incidents | The declaration drafted by the cascade from the same incident record and logged; your team files it | Cyber Incidents |
NIS2 was due for transposition across the EU by 17 October 2024. As of September 2026 the French transposition law (the projet de loi résilience, which also recasts the OIV regime) is still before Parliament, and the European Commission referred France to the Court of Justice in July 2026.
A QUARTER, THEN THE DAY THE ARS ASKS
Four moments of an ordinary quarter in a hospital group, and what the platform had already done; then the day the ARS asks, in three steps. Governance records only: patient data never enters the platform.
A normal quarter
WEEK 2
The imaging workstation derogation comes up for renewal.
Renewed with a new expiry once the segmentation it depends on was verified.
Surface: Derogation lane
alert: WEEK 5
An advisory matched the laboratory system.
The risk moved, a finding opened, and the editor’s re-assessment fired on its own.
Surface: Risk Register
verified: WEEK 8
The directoire read exposure by care activity.
Emergency, imaging, laboratory and pharmacy against appetite, each figure opening on its evidence.
Surface: Cyber Cockpit
WEEK 12
Crisis exercise.
The chain named which activities degrade first and which suppliers to call, before the scenario started.
Surface: Business Impact Analysis
The day the ARS asks
THE REQUEST
After an incident, the ARS asks what was declared, when, and what has changed since.
The incident record answered all three: its classification, its cascade log, the actions since.
Surface: Cyber Incidents
WHAT OPENS
The incident record with its cascade log, the CERT Santé action, the derogations touching the affected pathway.
Each derogation with its compensating measures and its expiry, on the pathway the incident hit.
Surface: Derogation lane
WHAT IS EXPORTED
The incident record and the controls’ evidence.
From Audit mode, scoped to the pathway and the period the ARS asked about.
Surface: Audit mode
Illustrative quarter: the moments are fictional, the surfaces are the product’s. Governance records only: incident classification, evidence, suppliers.
FROM THE FIELD
CYBER COLLECTIVE LAB · Edition 5
What NIS2 changes for an entity that had never been regulated on cyber before: the round table on NIS2, DORA and CRA, read from the hospital’s side of the table.
Measured with our design-partner CISOs, figures under continuous validation.
UNDER THE HOOD
Pathways, systems, suppliers.
Learn more
Derogations with an expiry.
Learn more
Editors, hosts, télémaintenance.
Learn more
The connectors feeding this page
FAQ
No, and it does not need to: Mindlapse holds governance records, risks, controls, evidence, suppliers, incident classification, never patient data. Personal health data must not be uploaded; the HDS chain is a decision about your hosts, which the platform helps you assess.
No, deliberately. The map holds the care activities and the systems that carry them, with their risks, suppliers and exceptions; a device register belongs to biomedical engineering and stays there.
As a derogation in its own lane: compensating measures with a scored coverage, an approver at the level the residual risk requires, and an expiry that reopens the decision instead of letting the exception outlive everyone who signed it.
You do. The cascade qualifies the incident once and drafts the CERT Santé, CNIL and NIS2 notifications from the same record, with the log; your team files each one on its portal.
Yes. Each establishment is an entity with its own scoped roles and register, the group reads the consolidated view, and the one RSSI works from a single action queue across all of them.
Read it next
Security decided at the start, assisted by AI, proven at closure.
Learn more
Map every framework to one control set; prove it any day; run the incident cascade on one record.
Learn more
Your Monday posture: risks, exceptions, suppliers and the pack, from one register.
Learn more
Also by outcome
CARE, VERIFIED
A live session on your establishment: activities, télémaintenance, derogations, the directoire view.
Our host’s audience measurement (Vercel) uses no cookies and is not covered by this choice. Google Analytics and marketing trackers stay off until you say otherwise. Read the cookie policy
