I would need to give you a very deep dive into how europa and germany especially handle this so you can understand it ... I often forget how different the way p

I would need to give you a very deep dive into how europa and germany especially handle this so you can understand it ... I often forget how different the way people think about regulations is in the USA. On the surface: There is a joint initiative of the Federal Office of Civil Protection and Disaster Assistance (BBK) and the Federal Office for Information Security (BSI) which work with domain experts to define the abstract standards for critical infrastructure. There are more specialized sets where the German Hospital Federation (DKGeV) has more influence in how to make it happen for hospitals in particular. The whole regulation is set up to focus on continuous improvement, risk management, escalation processes, investigation of breaches and the like. It is related to ISO27001, but goes beyond that. Maybe comparing it to MilSpec makes it understandable to citizens of the USA: we want our hospitals IT infrastructure to be like the navy wants its warships: made out of steel, with redundant systems and sane compartmentalization so it can withstand most attacks. And we are willing to invest billions of tax money to get our existing hospitals up to these standards, because many are like viking longboats: they stay afloat and cure disease, but they are not protected against torpedoes. A hospital looses most of its infrastructure to a some ransomware? There is an investigation by the supervisory body into the technical and organizational details of the specific security incident and they really don't care about certifications printed by some private company that claims to have audited the hospital. The expected result is a "how this hospital intents to prevent this type of incident in the future" document. These standards are not about certifications of industry sector mediocrity waved around to shift blame and win liability cases in court. Also I don't think liability cases work that way over here, but i am not a lawyer.