NIS2 + critical infrastructure + § 391 SGB V · triple regulated
Cybersecurity for hospitals
Hospitals face multiple regulatory burdens: critical infrastructure under BSI-KritisV starting at 30,000 inpatient cases, a particularly important entity under NIS2, plus Section 391 of the German Social Code Book V (SGB V) for all hospitals with Section 108 authorization. We provide awareness training, phishing simulations, vulnerability management, and managed detection & response—tailored to 24/7 shift operations, medical technology, and the realities of patient care.
TYPICAL ATTACK SCENARIOS
The attacks we see in clinics every day.
Hospitals are not attacked indiscriminately — the profiles are frighteningly consistent. Those who know the patterns can protect themselves in a targeted way instead of investing broadly.
OUR SOLUTIONS
Four services that together create a security foundation suited to a clinic.
Individual measures are not enough. Awareness without phishing simulation is theory, vulnerability scanners without a SOC are lists without any response. We combine the four building blocks that jointly address NIS2, KRITIS, and Section 391 of SGB V.
Continuous training
Phishing Simulation as a Service
Monthly, clinic-realistic campaigns — fake applications, lab results, HIS password resets. Measurable improvements in click rate and report rate, directly usable as NIS2 compliance evidence.
Employee Resilience
Security Awareness Training
Annual core course ~20 minutes, quarterly spotlights 1–2 minutes. Role-based content for nursing, physicians, administration, and technology. Directly meets the requirements of NIS2 Art. 21 and § 391 SGB V.
Know the attack surface
Vulnerability Management
Continuous asset discovery, passive detection of medical devices (no active scanning on IoMT — HHS 405(d) best practice), active scanning on IT infrastructure, clinical prioritization instead of CVSS noise, remediation tracking through to the closed vulnerability — and audit-ready evidence for B3S and Section 39 BSIG.
24/7 Managed SOC
Incident Detection & Response
Continuous SIEM monitoring, EDR management, healthcare threat intelligence, and German-speaking analysts. Incident response with clinic-compatible containment logic and prepared NIS2 notifications in accordance with Section 32 of the BSIG.
WHY ENTROPY CS
We build cybersecurity that can withstand everyday clinical operations.
Generic service providers fail when it comes to the unique demands of clinics. We are built for this environment — with the compromises that are truly necessary between patient safety, availability, and regulatory compliance.
Clinical Vocabulary
We speak KIS, RIS, PACS, lab interfaces, TI connectors—not just servers and firewalls. Awareness content, phishing bait, and incident playbooks are specifically tailored to clinic workflows.
Regulatory multiple use
Each of our services produces evidence that can be used at the same time for NIS2, KRITIS verification, and Section 391 of the German Social Code Book V. Instead of three separate documentation streams, you get one consolidated record — effort once, use it three times.
Service mandate as a guiding principle
Each measure — scanner window, containment decision, training time — is judged by whether it jeopardizes patient care. Cybersecurity is a means, not an end in itself.
The questions we regularly hear from executive management, CISOs, and IT leaders in hospitals. More questions directly in the free risk assessment.