Not long ago, implementing the B3S standard was not obligatory in hospitals covered by KRITIS. However, with the high risks of damage that cyber threats can cause the critical healthcare infrastructure, starting from January 1, 2022, all hospitals in Germany have been legally obliged to implement the industry-specific security standard approved by the BSI IT-Grundschutz.
Thus, it has been compulsory for all hospitals to take state-of-the-art organizational and technical precautions to avoid disruptions to data availability, integrity, and confidentiality.