Implementation of NIS2, SOC, and SIEM for Healthcare Facilities

Even a brief outage can have serious consequences for your facility. ITH supports hospitals and clinics at every stage of NIS2 implementation. We provide 24/7 security monitoring (SOC) and a SIEM system that detects threats before they disrupt business continuity.

Quick e-mail offer Let's talk!

Quick e-mail offer Let's talk!

What is the NIS2 Directive, and why is it crucial for protecting public health?

The NIS2 Directive entered into force in early 2023, replacing the earlier NIS Directive from 2016. It establishes a higher level of cybersecurity than before in all EU member states.
The NIS2 Directive was implemented in Poland as an amendment to the Act on the National Cybersecurity System in early 2026. Cybersecurity obligations have been in effect since April 3, 2026.
The directive covers companies in 18 economic sectors deemed critical to the functioning of the state. These entities are divided into critical and important categories. The scope of oversight and obligations depends on which category you fall into.

Who is affected by NIS2 in the healthcare sector?

Whether entities in the healthcare sector are subject to NIS2 is determined by two main factors:

1. Type of Services Provided

In accordance with the regulations, the requirements apply, among other things, to:

hospitals (public and private)—they almost always fall under the category of critical entities;
entities engaged in research and development of pharmaceuticals;
manufacturers of basic pharmaceuticals and medical devices;
reference laboratories and larger diagnostic laboratories.

2. Company Size

Apart from hospitals, most medical facilities (e.g., smaller specialty clinics—AOS—or primary care practices — POZ) are subject to the provisions of NIS2 only if they meet the criteria for a medium-sized or large enterprise: at least 50 employees or an annual turnover exceeding 10 million EUR.

If you are unsure which category your facility falls under, it is worth verifying this on a case-by-case basis. Whether you qualify as a key or important entity determines the scope of your responsibilities, the frequency of audits, and the amount of any potential penalties.

Obligations under NIS2

The NIS2 Directive introduces new obligations that, in practice, require a systematic approach to cyber risk management. For a healthcare facility, the most important obligations are:

Implementation of Risk Management Measures
commensurate with the estimated risk and the actual threats to which the institution’s IT systems are exposed.
Regular audits
that demonstrate compliance with safety requirements. You are required to provide up-to-date audit documentation upon request by the competent authorities.
Reporting incidents to the CSIRT within strictly defined timeframes:
1. Initial report: within 24 hours of the incident being detected;
2. supplementary report: within 72 hours of becoming aware of the incident;
3. Final report: within one month of the incident’s conclusion.
Ensuring Business Continuity
and the implementation of crisis management plans in the event of a cyberattack—for a medical facility, this is a matter of patient safety.
Monitoring the Security of Your Suppliers
and subcontractors who have access to the facility’s systems.
Regular training and team awareness-building
Entities subject to NIS2 have until April 3, 2027, to fully implement an Information Security Management System and risk management procedures. ITH offers full implementation, freeing you from the need to build your own cybersecurity team.

Penalties and Personal Liability for Noncompliance

Failure to comply with NIS2 regulations carries real risks—not only financial, but also personal for senior management:

The maximum administrative fine for critical entities may be up to 10 million euros or 2% of the organization’s annual turnover. The higher amount applies.
The management board bears personal responsibility for any failure to properly implement compliance measures. Penalties for the management board include a ban on holding executive positions. Additional sanctions may include fines of up to 300% of their compensation.

Cybersecurity is therefore no longer solely the responsibility of the IT department; it has become part of management’s responsibilities, on par with the financial and legal security of the entire organization.

Comprehensive protection for medical facilities—four pillars of a single offering

ITH will guide your organization through the entire implementation process: a single audit, a consistent process managed by a single provider.

1. NIS2 Implementation —From Audit to Certification

We start with an audit to identify cybersecurity vulnerabilities. The next step is to prepare comprehensive documentation ready for inspection and to train the entire team. We conclude the implementation process with a final report and the launch of ongoing monitoring.

2. SOC - Your facility is protected 24/7/365

Our team of analysts monitors your facility’s infrastructure around the clock. We provide real-time threat detection and support your organization in responding to incidents, even at night and on weekends.

3. SIEM - Full Visibility of the Infrastructure

This system collects and correlates events from servers, network devices, and endpoints in a single location and detects potential threats before they disrupt your facility's operations.

4. Cybersecurity Training — Informed Staff as the First Line of Defense

The goal of these training sessions is to prepare organizations for compliance audits and to increase their overall resilience against cyberattacks. Don’t let your company become an easy target. Regular training helps employees respond effectively to constantly evolving threats.

SOC for Your Medical Facility

A cyberattack can paralyze registration systems, medical records, or diagnostic equipment, which directly affects patients. The ITH team takes on the responsibility of continuously monitoring the facility’s infrastructure and responding to real threats before they cause serious damage:

24/7/365 Monitoring — ITH ensures your organization’s security around the clock.
Real-time threat detection, with a response time of less than 15 minutes and immediate isolation of compromised systems.
Ransomware Protection — We detect characteristic file-encryption patterns before your company’s files are locked.
Detecting phishing and BEC, one of the most common methods used to gain unauthorized access to the administrative systems of healthcare facilities.
Complete documentation of cybersecurity incidents in accordance with NIS2 requirements and timely reporting to the relevant authorities.
Interim report (monthly and quarterly risk overview) for the board of directors, written without technical jargon.

Learn more about SOC ITH

SIEM – a security monitoring center for your facility

The ITH SIEM system collects logs from various sources, correlates security events, and delivers real-time security alerts.

SIEM collects data from:

EDR/XDR systems and staff client workstations (Windows/Linux/macOS),
hospital servers and IT systems,
firewalls, IDS/IPS systems, and network devices,
backup systems and backup copies of medical records,
cloud environments and third-party integrations.

A managed SIEM eliminates the need to invest in licenses, infrastructure, or your own team of cybersecurity specialists. Your facility receives a turnkey environment maintained by ITH experts.

See the full capabilities of ITH SIEM →

Cybersecurity training tailored to healthcare professionals

Even the best-secured infrastructure won’t help if a team member opens a malicious attachment or provides login credentials in response to a fraudulent phone call. Our training programs combine theory with practice. The hands-on components of the training help employees understand that their everyday decisions matter for the security of the entire company.

Choose the plan that's right for your organization:

2 HOURS

Basic Security Training

The perfect introduction for all employees. Raising awareness of everyday hazards.

Due Diligence in Data Protection—Legal Basis
Password Creation and Multi-Factor Authentication (MFA)
Recognizing Phishing
No limit on the number of participants—the ability to train the entire organization at once

I choose

Standard Security Training

It expands participants' knowledge of the practical aspects of information security. Each participant receives training materials and a certificate.

Data Security for Data Processed in the Cloud and on Mobile Devices
Legal obligations (NIS2, GDPR)
Social Engineering in Business Relationships
Training materials and a personalized certificate for each participant

I choose

6 HOURS

Premium Security Training

Advanced incident response procedures and crisis management for IT and security personnel and executive management.

Attack simulations—deepfakes, spoofing
Documentation as evidence of due diligence before the supervisory authority
"Before" and "After" Knowledge Tests
+1 hour of consultation in areas requiring improvement

I choose

Why do healthcare facilities choose ITH?

One partner, a complete security ecosystem

Audits, NIS2 and SOC implementation, SIEM, training, as well as internet services, colocation, backup, and managed firewalls—all from a single...

Operator with its own network

ITH is not only a security integrator but also an electronic communications provider with full visibility into network traffic. This...

Scalability without renegotiating the contract

Is your facility expanding its telemedicine services, opening new departments, or implementing a new HIS system? The scope of protection...

Over 20 years of experience

The ITH team has many years of experience in the IT and telecommunications markets; we design, maintain, and secure networks...

Don't wait for the first inspection or the first incident

Implementing NIS2 at a healthcare facility is a process that takes time. The sooner you begin preparations, the better your chances of avoiding costly consequences.

Quick e-mail offer Let's talk!

They trusted us

See more references

Modern Cloud Solutions for Business. Public Cloud and secure connections to global clouds provide flexibility and access to IT resources from anywhere.

Professional data centers: dedicated servers, colocation and server administration. We guarantee security, high availability and direct connections to global clouds.

Internet access for business in two product lines: symmetrical lines with guaranteed parameters for large companies or asymmetrical lines for smaller customers.

Comprehensive IT security services. Audits, vulnerability scans, protection against DDoS attacks, managed firewall and backups. Everything your company needs to operate securely.

Construction and maintenance of modern technical infrastructure: structured networks, video surveillance, access control and alarm systems, and intelligent buildings.

IT support in a service model. We provide support for businesses, conferences and events, server and network infrastructure administration, and WiFi design and monitoring.

Stable and secure hosting environments for enterprise applications and websites. Tailored solutions for businesses requiring reliable infrastructure.

Telecommunications solutions for business: virtual PBX, SIP Trunk, telephone subscriptions, IP phones and web-based systems. Corporate communications always under full control.

Write to us

Support
Maintenance

ITH NOC
Management Center
Infrastructure ITH

+48 22 539 99 99
[email protected]

Open all week, 24 hours a day

Solutions
for you

ITH sales team

+48 22 539 99 99
[email protected]

Open Monday through Friday from 9:00 a.m. to 8:00 p.m.

First and Last Name*

Company Email Address*

Phone Number*

Subject of the Conversation*

I Accept the Marketing Consent* Expand This offer does not constitute an offer within the meaning of the Civil Code. This offer is intended solely for business customers. All prices listed are net prices. * Pursuant to Article 23 of the Act of August 23, 1997, on the Protection of Personal Data (Journal of Laws of 2016, No. 922 of June 28, 2016, consolidated text), I hereby consent to the processing of my personal data provided in the form above (i.e., Tax Identification Number (NIP), phone number, email address) by ITH Sp. z o.o., with its registered office in Warsaw, ul. Nowogrodzka 31, 00-511 Warsaw, registered in the Register of Entrepreneurs of the National Court Register under KRS number 0000469801, Tax ID (NIP): 7010389026, REGON: 146777630, for the purpose of presenting and fulfilling a commercial offer. I have been informed of my right to access the data I have provided, to modify it, and to object to its further processing. The controller of personal data is ITH Sp. z o.o., with its registered office in Warsaw, at ul. Nowogrodzka 31, 00-511 Warsaw, registered in the Register of Entrepreneurs of the National Court Register under KRS number 0000469801, NIP: 7010389026, REGON: 146777630.

FAQ

Healthcare is one of the key sectors explicitly identified in the NIS2 Directive and the Act on the National Cybersecurity System. These obligations apply to healthcare entities that meet the size criteria, but the scope may be broader in practice during national implementation—which is why it’s worth verifying this on a case-by-case basis. ITH conducts such an assessment at the start of our collaboration.

Both categories are required to implement risk management measures, report incidents, and conduct regular training; however, key entities are subject to stricter oversight by the competent authorities—including proactive inspections, rather than merely responding to reports. The manager of a critical entity also bears a broader scope of personal liability.

Typically, the process takes anywhere from 14 business days to several months, depending on the size of the organization and the number of systems to be connected. SIEM configuration and security rule tuning are carried out simultaneously, and a dedicated ITH engineer supports the organization throughout the entire process.

In accordance with NIS2 security requirements, a multi-stage model is in place: an early warning within 24 hours of detection, a detailed incident report within 72 hours, and a periodic report within one month. The ITH SOC maintains this documentation on behalf of the facility, ensuring compliance at every stage.

Only security events are collected; medical records and patients’ clinical data are not collected. The data is stored on ITH servers located in Poland, in accordance with the GDPR and the data processing agreement.

Yes, and that’s a key element of compliance. NIS2 places direct, personal responsibility on management. The Premium Package was designed specifically with these individuals in mind.

Implementation of NIS2, SOC, and SIEM for Healthcare Facilities

What is the NIS2 Directive, and why is it crucial for protecting public health?