Service availability is part of the decision
In healthcare, applying a patch may require supplier validation, testing and user coordination. Decisions need the installed version, vulnerability applicability and maintenance conditions. An unassessed alert or outstanding supplier response must remain identifiable in tracking.
The lessons learned published by CERT Santé and CERT-FR on 2 October 2026 highlight the importance of addressing digital-product vulnerabilities and engaging with vendors. For the organisation, this starts by matching advisories to its inventory and the constraints of affected services.
Sources: CERT Santé and CERT-FR: lessons learned on healthcare-product vulnerabilities, 2 October 2026
Establish what is actually affected before scheduling work
Distinguish the business application, its components, the operating system and the deployed version. Check package provenance, enabled functions and vendor-described conditions. An incomplete case remains under investigation, with a precise request sent to the supplier or team holding the information.
Set priority according to supported functions, access, exposure and maintenance constraints. Isolation may change exploitation conditions without making the alert false. Likewise, a temporary access restriction is mitigation, not a fix. The register retains the chosen treatment and decision owner.
Fictional case: a service application awaiting validation
In this fictional example, Les Ormes uses coordination application Service-R 5.1. Advisory DEMO-SANTE-01 concerns an embedded library whose exact version is unknown to the organisation. A dated request asks the vendor to confirm the inventory and whether the affected function is present.
The vendor confirms applicability and prepares an update. The technical team organises testing with the service owner. An access restriction is adopted in the meantime, with reassessment if exposure or the advisory changes. Closure awaits evidence of the installed version and the agreed verification, beyond the patch merely being available.
| Fictional case status | Next step | Retained evidence |
|---|---|---|
| Under investigation | Obtain the supplier inventory | Dated request and response |
| Applicable | Prepare testing and maintenance | Assessment and change plan |
| Temporary measure | Reassess its conditions | Decision, owner and trigger |
| Treatment completed | Verify the relevant version | Deployment and verification evidence |
Identify the organisation’s framework and the product’s framework
Healthcare is included in NIS2; applicability to an organisation depends on the directive’s criteria, exceptions and national implementation. The CRA is assessed by product and role. Article 2 excludes products covered by EU medical-device and in-vitro diagnostic regulations, among others. These are therefore separate assessments.
Product references, versions and necessary technical details are often enough to open an assessment. Limit exchanges to that information through the agreed channels. If analysis requires access to a sensitive environment, first define authorisations and necessary data with the relevant owners.
Sources: Directive (EU) 2022/2555, Articles 2, 4 and 21 and annexes, CRA, Regulation (EU) 2024/2847, Articles 2, 13, 69, 71 and Annex I
Reduce reassessment and prepare operations more effectively
Start with an identified group of services, inventories, support agreements and supplier contacts. Define evidence needed for assessment and closure. Reviews then track missing responses, actions without owners, exceptions to reassess and fixes ready for validation.
CyberLifeCycle monitors, assesses vulnerabilities and tracks actions within your scope. Your teams receive case files, alerts and reports to prepare operations. Evaluate this work through preparation time and cases requiring reassessment. The organisation and authorised providers decide and implement changes while protecting service continuity.
Sources consulted
- Directive (EU) 2022/2555, Articles 2, 4 and 21 and annexesAccessed on 30 October 2026.
- CRA, Regulation (EU) 2024/2847, Articles 2, 13, 69, 71 and Annex IAccessed on 30 October 2026.
- CERT Santé and CERT-FR: lessons learned on healthcare-product vulnerabilities, 2 October 2026Accessed on 30 October 2026.