The European Union Agency for Cybersecurity (ENISA) has published new procurement guidelines to help hospitals and healthcare providers strengthen cybersecurity when buying products and services.

The guidelines cover every stage of the procurement process, outlining cybersecurity requirements and the information suppliers must provide. They are aligned with key EU regulations, including the NIS2 Directive, Medical Device Regulations, GDPR, and the European Health Data Space Regulation.

The guidance also addresses medical device manufacturers and suppliers of clinical information and EHR systems, networking solutions, cloud services and related products, helping them understand the cybersecurity requirements expected when delivering solutions to healthcare entities. By doing so, suppliers can better demonstrate compliance and align their offerings with the sector’s cybersecurity and policy expectations.