HEALTH-ER

ECCC cluster

Seven projects, one healthcare cybersecurity agenda

HEALTH-ER is one of seven projects awarded under the CYBERHEALTH call. Together they run pilots in 14 EU countries, and the European Cybersecurity Competence Centre coordinates them as a cluster so that results become shared outcomes rather than seven parallel efforts.

projects
7
EU countries with pilots
14
working groups
7
Action Plan pillars
4

Programme targets

What the cluster is measured on

Cumulative indicators across all seven projects, as set out by the ECCC. HEALTH-ER contributes to every one of them.

Cumulative cluster KPIs at month 24 and month 36
IndicatorM24M36
Healthcare and health institutions involved600850
Pilot demo installations200300
Dedicated training courses200400
Healthcare staff trained10,00014,000
Tools, services, methods and practices300500
Operational plans, playbooks and case studies3050

Working groups

Where the coordination happens

Each project joins the groups relevant to it and may co-chair where it can lead. HEALTH-ER participates across all seven tracks.

  1. WG 01

    Coordination, direction and reporting

    Steering the cluster, agreeing shared timelines and reporting progress back to the ECCC.

  2. WG 02

    Pilots and training

    Comparing pilot designs, sharing training material and coordinating cross-border exercises.

  3. WG 03

    Cumulative KPIs and deliverables

    Aligning indicators so the seven projects report comparable evidence against the programme targets.

  4. WG 04

    Technology development and tools

    Detection logic, AI components, SOC integration and the tools deployed in hospitals.

  5. WG 05

    Events, dissemination and communications

    Joint events, shared messaging and coordinated outreach to the healthcare sector.

  6. WG 06

    Operational plans, playbooks and case studies

    Reusable incident-response and business-continuity playbooks, and documented case studies.

  7. WG 07

    Interaction with ENISA

    Connecting cluster output to ENISA guidance, the threat landscape and the health ISAC.

What HEALTH-ER brings

Technical assets, pilot evidence, and an open route in

The project is ready to cooperate with peer projects through practical working groups and shared activities, contributing in five areas.

  • Healthcare threat intelligence and early warning

    Common threat topics, CTI exchange formats, trusted feeds, indicators and collaborative threat-hunting hypotheses.

  • SOCaaS, SOAR and incident-response playbooks

    Comparison and reuse of detection logic, response workflows, CACAO playbooks and business-continuity procedures.

  • Medical devices, IoMT and hospital OT

    Shared scenarios, threat models and validation approaches that reflect patient-safety and clinical-service impacts.

  • Cyber ranges, training and awareness

    Reusable ransomware, medical-device and clinical-disruption scenarios, with role-based training and awareness material.

  • Compliance, reporting and common evaluation

    Mapping results to NIS2, GDPR, MDR, CRA, EHDS and ENISA guidance, and developing comparable indicators across projects.

Cluster cooperation opportunity

The HEALTH-ER Open Pilot is available as a route for joint workshops, cross-project testing, reusable training material and comparable validation evidence across European healthcare providers — for the cluster as a whole, not only for this project.

About the Open Pilot

EU Action Plan

All seven projects map to the four pillars

The cluster exists to make that mapping legible: comparable evidence, shared playbooks and a single line of sight from hospital pilots to European policy.

  1. Pillar 1

    Prevent

    Preparedness, systematic risk assessment, procurement guidance, supply-chain risk management and tailored training for healthcare professionals.

  2. Pillar 2

    Detect

    Advanced monitoring, AI-enhanced detection and an EU-wide early-warning capability for the healthcare sector.

  3. Pillar 3

    Respond & Recover

    Incident-response playbooks, business-continuity plans, CSIRT support and cyber-range exercises to contain and recover from attacks.

  4. Pillar 4

    Deter

    Compliance with NIS2 and GDPR, certification pathways, incident and ransom-payment reporting, and sector-wide deterrence measures.

The cluster

Projects

The other six projects are added here as the cluster formalises its membership and public information becomes available.

  • HEALTH-ER

    This project

    HEALTHcare cybersecurity framework for Enhanced preparedness and Resilience

    An AI-based cybersecurity framework for EU hospitals and healthcare providers, centred on a SOC-as-a-Service and supported by preparedness, assessment and capacity-building services.

    Coordinator
    OBRELA Security Industries
    GA
    101299528
  • Cluster project details to follow
  • Cluster project details to follow
  • Cluster project details to follow
  • Cluster project details to follow
  • Cluster project details to follow
  • Cluster project details to follow
European Cybersecurity Competence Centre

Cluster contact

Christos Forotzidis · OBRELA Security Industries · c.forotzidis@obrela.com

For cooperation between cluster projects, joint workshops and cross-project testing.

About the ECCC ↗