Healthcare

For organisations in any sector seeking to standardise processes and manage customer expectations systematically.

For organisations that demonstrate product or service conformity on the basis of measurement results.

For organisations where service interruption is critical, or that are multi-site or critical suppliers.

For organisations that process data, access customer systems or provide cloud services.

For organisations processing personally identifiable information within an ISO 27001 scope.

For organisations and groups of organisations establishing corporate governance over records.

For organisations carrying a broad inventory of regulatory obligations.

For organisations providing facility services or managing large property portfolios.

For organisations that develop, provide or use artificial intelligence in high-impact contexts.

For businesses seeking to address employee, site and operational risks systematically.

For organisations with measurable energy consumption and energy performance targets.

A quality management system for organisations delivering healthcare services.

For organisations that design, manufacture, install or service medical devices.

For businesses producing and supplying primary packaging materials for medicinal products.

For organisations managing air quality in building and facility interiors.

For laboratories and organisations working with hazardous biological materials.

HDS is a French statutory certification for anyone hosting personal health data as a GDPR-article-28 processor, issued by COFRAC-accredited bodies.

C5 is the BSI's cloud security criteria catalogue for Germany — auditors examine against it and the output is an attestation (Testat), not a certificate.

MARS-E is CMS's security and privacy standard for ACA Administering Entities, built on the CMS Acceptable Risk Safeguards and NIST SP 800-53 Rev 4.

The Cyber Assessment Framework is the NCSC's outcome-based framework for assessing cyber resilience, structured around 4 objectives and 41 assessments.

The DSPT is NHS England's mandatory self-assessment toolkit for organisations with access to NHS patient data — the output is a status, not a certificate.

EPCS is the DEA rule under 21 CFR 1311.300: providers of electronic prescription or pharmacy applications must obtain a third-party audit.