Built-in compliance
Ressaut is built around 19 normative and regulatory frameworks applicable to hospitals, regional hospital groups (GHT), care homes and social care organizations.
International standards
ISO 22301:2019
Business Continuity Management Systems
Ressaut covers clauses 4 to 10. Each module is mapped to the corresponding requirements.
| Clause | Domain | Ressaut coverage |
|---|---|---|
| §4 | Context | Organizational context, interested parties, scope |
| §5 | Leadership | Policy, roles, responsibilities, RACI |
| §6 | Planning | Risks, opportunities, continuity objectives |
| §7 | Support | Resources, competence, documentation |
| §8 | Operation | BIA, strategies, plans, exercises, crisis |
| §9 | Performance evaluation | Monitoring, audit, management review |
| §10 | Improvement | Non-conformities, corrective actions, PDCA |
ISO 22331:2018
Business Continuity Strategy — Guidelines
Ressaut applies ISO 22331 to build and arbitrate continuity strategies: treatment options, before/during/after mitigation and prioritisation based on BIA criticality.
| Clause | Domain | Ressaut coverage |
|---|---|---|
| §5 | Options analysis | Continuity options per activity, before/during/after |
| §6 | Selection | Cost / time / criticality trade-offs, required resources |
| §7 | Implementation | Translation into plans (BCP) and resource requirements |
ISO 22317:2021
Business Impact Analysis (BIA)
Ressaut's BIA module follows the ISO 22317 methodology with MTPD, RTO, RPO, MBCO and resource dependencies.
| Clause | Domain | Ressaut coverage |
|---|---|---|
| §5 | BIA planning | Scope, schedule, responsibilities |
| §6 | Conducting the BIA | Activities, impacts, dependencies, criticality |
| §7 | BIA results | Consolidation, disruption points, validation |
ISO 22361:2022
Crisis Management — Guidelines
Ressaut's crisis room implements the ISO 22361 decision-making framework: facts, uncertainties, options, decision, justification.
| Clause | Domain | Ressaut coverage |
|---|---|---|
| §5 | Crisis leadership | Organisation, roles, activation |
| §6 | Decision-making | Crisis log, structured situation & decision |
| §7 | Communication | Plans, message templates, spokespersons |
ISO 22398:2013
Guidelines for Exercises
The simulation module covers the full exercise cycle: annual programme, execution, evaluation and debrief.
| Clause | Domain | Ressaut coverage |
|---|---|---|
| §5-6 | Programme | Planning, objectives, scenarios |
| §7 | Execution | Multiplayer simulation, facilitator, players |
| §8 | Evaluation | Debrief, lessons learned, recommendations, actions |
ISO 27001:2022
Information Security Management Systems
Ressaut covers the ISMS continuity requirements: critical IT asset inventory, risk treatment and IT continuity plans.
| Clause | Domain | Ressaut coverage |
|---|---|---|
| §6.1 | IT risks | Identification, analysis and treatment of security risks |
| §8.1 | Operational planning | Critical IT asset inventory |
| A.5.30 | IT continuity | Information systems continuity plans |
| A.6.8 | IT incidents | Security incident management and notification |
European directives
NIS2
French transposition in progressDirective (EU) 2022/2555
Healthcare organizations are essential entities under NIS2. Ressaut helps demonstrate compliance through risk management, continuity plans and exercises.
CER
French transposition in progressDirective (EU) 2022/2557 — Resilience of Critical Entities
The "CER" directive, the physical and operational counterpart to NIS2. Healthcare facilities are among the critical sectors: risk assessment, resilience plans and continuity of essential services. Ressaut tooling covers the risk analysis, BIA and corresponding continuity plans.
GDPR-Art32
In forceGDPR Article 32 — Security of processing
Article 32 of the GDPR requires technical measures ensuring the availability and resilience of health data. Ressaut contributes through IT continuity plans and exercises.
Healthcare sector frameworks
HAS-CERT-2027
In forceHAS Healthcare Facility Certification (V2027)
New HAS framework validated in November 2024. Ressaut supports the criteria relating to continuity and crisis: 3.1-05 "management of exceptional health situations" and 3.1-07 "control of digital security risks".
HAS-ESSMS-2025
In forceQuality Evaluation Manual for Social Care — Objective 3.14
Objective 3.14 of the ESSMS manual covers crisis management and business continuity for care homes and social care organisations. Ressaut fully covers this objective.
HDS-2018
In forceHealth Data Hosting Reference Framework
The HDS framework sets out 35 requirements covering the availability, integrity and continuity of systems hosting personal health data.
French regulatory texts
Public Health Code — Regional Hospital Groups (GHT)
Articles L.6132-1 et seq. organise territorial cooperation between healthcare facilities. Ressaut adds a territorial layer: continuity consolidation across the 135 GHT, while preserving the autonomy of each member facility.
DGOS Instruction on Healthcare Business Continuity Plans
French Ministry of Health instruction requiring healthcare facilities to implement and regularly test a BCP. Ressaut structures, documents and schedules the required exercises.
Public Health Code — White Plan & Health Emergency
Articles L.3131-1 et seq. of the French Public Health Code define the white plan and the healthcare facility support plan in exceptional health situations.
Social Action Code — Art. L.312-1
Sets the service continuity obligations for social and medico-social establishments and services (care homes, long-stay units, home care services).
CaRE Programme — Cybersecurity Acceleration & Resilience
The French Ministry of Health's CaRE programme requires cyber crisis exercises and a maturity assessment. Ressaut's flash assessment evaluates your maturity in 10 questions.
EBIOS Risk Manager — ANSSI Risk Assessment Method
Official ANSSI 5-workshop risk analysis method. Ressaut integrates EBIOS results into critical activity identification and plan prioritisation.
ANSSI Guide — Running a Cyber Crisis Exercise
The ANSSI guide defines the cyber crisis exercise framework. Ressaut's simulation module implements this framework with facilitator, players and structured debrief.
Need help with your compliance journey?
Discover how Ressaut simplifies your regulatory compliance across 19 frameworks.
Request a demo