The EU Cybersecurity Act introduces cybersecurity certification framework for ICT products, services and processes. Following ENISA's EUCC (the Common Criteria based European candidate cybersecurity certification scheme), we provide the Security Problem and identify Security Requirements of a healthcare specific product through a Protection Profile. We consult ENISA's reports to identify the most impactful assets in healthcare that should be prioritized for certification. We select a sub-category system of Clinical Information Systems, such as Picture Archiving and Communication System (PACS) for Protection Profile. Based on five use-cases of PACS, we define the Security Problem (assumptions, organizational security policies, threats) and we elaborate the Security Objectives. We, further, conduct a sector specific analysis of challenges and threats in healthcare sector to supplement the PACS specific threats. We detail Security Objectives from the Cybersecurity Act, and we offer a combination of these two elements, the broader scope of threats and objectives, as a baseline for future Protection Profiles of healthcare specific products. We further provide PACS specific Security Functional Requirements, and we conclude with a guideline for selecting suitable Security Assurance Requirements.

Security needs and demands are nowadays constantly increasing for cybersecurity professionals and organisations in general. A cyber range provides a multipurpose virtual environment, which organisations can utilise for training, prototyping and certification of new technologies and create security testing environments that would otherwise be impossible to create. Being the equivalent of classic shooting ranges, cyber ranges are closed and controlled testbeds that contain all the necessary tools, networks and user simulations that are required for all intended security purposes. Within the scope of the ECHO project, a federation of interconnected cyber ranges form the foundation of the ECHO demonstration cases, providing the host environment in which three demonstration cases will be executed and demonstrate the added value that cyber ranges bring in the development of technology roadmaps, cyberskills development as well as certification testing.

No abstract