A ransomware attack on a hospital is a patient-safety question, not just an IT one. We prepare the executive board, crisis team and CISO before the worst case: executive tabletops, IR playbooks, recovery prioritisation and reporting drills. We do not run an in-house SOC and we do not perform live incident response. We make you response-capable and connect you with your external IR provider and cyber insurer.
For hospital CISOs, IT leads, crisis teams, executive boards, cantonal hospital groups and nursing homes
When systems go down, it is not first about data, but about the emergency department, OR scheduling, laboratory and medication. That is exactly why ransomware readiness belongs on the executive agenda, before anything happens.
Healthcare providers are among the most frequently affected by ransomware worldwide. Statistics show long downtimes, postponed procedures, patient diversions and ransom demands in the millions, and in many cases a recovery that takes weeks rather than days.
The most expensive mistake is inventing the response only once the incident hits. Anyone who has not rehearsed decision paths, escalation levels and recovery priorities in advance loses, in the first hours, exactly the time that determines patient safety and the scale of the damage.
We do not name specific affected hospitals. We work with anonymised scenarios based on real attack patterns and turn them into an exercise tailored to your organisation.
Our mandate is readiness, not deployment. We build the preparation that makes your crisis team capable in the worst case, and we are honest about the boundary of our scope.
We facilitate executive tabletop exercises for the board and crisis team in which a realistic ransomware scenario is played through: who decides what, when to escalate, when to report, how to communicate internally and to patients. From that we develop concrete IR playbooks, a recovery prioritisation of the clinically critical systems and reporting drills for the BACS 24h reporting duty.
Before the worst case we prepare interfaces and escalation paths to a named external IR provider and to your cyber insurer: contact chains, retainer templates, data-exchange routes and decision triggers are defined and tested in the exercise, so that nobody has to start from zero in an emergency.
Clearly delimited: SIDD does not operate a 24/7 SOC and does not perform live incident response. We do not coordinate the ongoing response during an incident and do not take on technical containment, forensics or live recovery. Those roles sit with your named IR provider. We ensure that the handover to them is prepared, rehearsed and contractually sound.
We capture your starting point: backup and recovery assumptions, clinically critical systems, existing plans, insurance and IR contracts, and reporting responsibilities.
We design a tailored, anonymised attack scenario and create or sharpen your IR playbooks, escalation matrix and recovery prioritisation.
We facilitate the exercise with the board and crisis team, including a BACS 24h reporting drill and a rehearsed handover to your external IR provider and insurer.
You receive a board-ready debrief report with prioritised gaps, recommendations and a roadmap, as a basis for vCISO support or an ISMS.
Readiness in a hospital is governance, law and technology at once. That is exactly the combination we bring, independent, because we do not sell an in-house SOC.
Our vCISO service anchors ransomware readiness in your governance: roles, responsibilities, reporting lines to the board and an exercise and maintenance rhythm, so playbooks do not go stale in a drawer.
Where a SIDD lawyer advises in a legal capacity, your information may be covered by professional secrecy under Art. 321 of the Swiss Criminal Code, valuable when sensitive weaknesses and incident assumptions must be analysed openly. We clarify the exact scope per mandate.
With penetration tests and vulnerability scans we check whether your recovery assumptions hold: are backups truly isolated and restorable, are critical paths segmented, does the architecture withstand the scenario. This keeps the tabletop from becoming wishful thinking.
Readiness is not a one-off: we embed exercises, playbooks and lessons learned into an ISO 27001-aligned ISMS, with audit-ready evidence that holds up in audits and regulator requests.
Reporting duties, the data-protection consequences of a data exfiltration, contracts with IR provider and insurer, board responsibility, all of that is first a legal question. Our mandate is led by doctorate-level lawyers with CIPP/E, backed by an in-house technical team.
We facilitate tabletops in German, French and English, relevant for French-speaking Switzerland, cantonal hospital groups and EU parent companies. Because we do not sell an in-house SOC or IR mandates, our recommendation on providers and insurers stays independent.
Executive ransomware tabletop
Fixed fee
A facilitated crisis simulation for the board and crisis team, before the incident, in a single day.
Readiness assessment & playbooks
Fixed fee
The solid groundwork: baseline assessment, playbooks and recovery prioritisation as the basis for the tabletop.
Ongoing vCISO support
on request
Readiness as a continuous task: recurring exercises, maintained playbooks and reporting to the board.
Our tool: LexCommand
LexCommand is our in-house, citation-backed legal AI for the law of Switzerland, Germany, Austria and the EU. Developed and run sovereignly in Switzerland by Priverion GmbH, the company behind SIDD. We do not just preach data sovereignty and provability, we built them into our own tool, alongside the Priverion Platform.
The AI runs self-hosted on Swiss infrastructure, with no external cloud LLMs. As an independent Swiss company with no foreign parent, we process your documents in an environment we control.
Every legal statement traces back to a retrievable primary source, or it does not appear at all. That makes our recommendations auditable and verifiable, instead of merely sounding plausible.
LexCommand takes over searching, cross-checking and sourcing. That shortens turnaround times and frees our senior advisors for judgement and client dialogue, with no loss of diligence.
We look at data protection, information security and AI security on a shared source base with a framework crosswalk. So you see overlapping obligations in one consolidated picture, instead of three isolated analyses.
For the BACS 24h reporting drill and the IR playbooks, concretely: LexCommand backs reporting duty, threshold and deadline with the version of the Swiss and EU rules valid on the reference date and an exact source for each, so your escalation matrix rests on verifiable obligations rather than assumptions.
Temporally deterministic (as of today or any reference date), with jurisdiction isolation (CH/DE/AT/EU) and a citation verifier at the end of every answer.
No. SIDD does not operate a 24/7 SOC and does not perform live incident response. We work exclusively before the incident: readiness assessment, executive tabletops, IR playbooks, recovery prioritisation and reporting drills. In an emergency, containment, forensics and recovery sit with your named external IR provider. We prepare the interfaces and escalation paths to them and to your cyber insurer in advance and rehearse the handover.
A facilitated crisis simulation at the table: with your board and crisis team we play through a realistic ransomware scenario and make real-time decisions on escalation, reporting, communication and recovery. No real code is involved and nothing is changed on your systems. What is exercised is decision paths, roles and collaboration.
We prepare and rehearse the 24-hour report: we clarify who is obliged to report, which threshold applies, what content is required and who in your organisation owns the report, and we provide templates. The actual report in an emergency is your responsibility or that of your mandated provider. We make you capable of it. We verify exact thresholds and deadlines case by case.
For hospital CISOs and IT leads, crisis teams, executive boards, cantonal hospital groups and nursing homes, wherever a system outage endangers patient care. We adapt scenario, participants and depth to your size and maturity.
Yes, optionally. With penetration tests and vulnerability scans we check whether backups are isolated and restorable, whether critical paths are segmented and whether the architecture withstands the scenario. This way the tabletop rests on robust assumptions rather than hope.
We start with a readiness assessment and an executive tabletop at a fixed fee, with a board-ready report and prioritised measures.