ISO 27001

Any organisation handling sensitive data — the baseline enterprise and public-sector buyers expect worldwide.

The international standard for an Information Security Management System (ISMS). Certification is the foundation your other certifications build on: most regional schemes extend or reuse its controls.

SOC 2 [Type II]

SaaS and cloud vendors selling to US enterprise customers.

An AICPA attestation against the Trust Services Criteria. Type II reports on controls operating over an observation window and are the assurance US buyers routinely request in procurement.

ISO 27017

Cloud service providers and organisations running regulated workloads in the cloud.

A code of practice adding cloud-specific security controls on top of ISO 27001. Usually pursued alongside 27001 and 27018.

ISO 27018

Cloud processors handling personally identifiable information.

Controls for protecting PII in public cloud environments, extending ISO 27001. Frequently bundled with 27017.

ISO 27701

Organisations demonstrating GDPR-aligned privacy governance.

A Privacy Information Management System (PIMS) extension to ISO 27001, mapping controls to GDPR and other privacy regimes..

HITRUST CSF

US healthcare vendors and their supply chain.

A prescriptive, certifiable framework harmonising HIPAA, ISO 27001 and NIST. The r2 validated assessment is the level most US health systems require of their vendors.

Cyber Essentials/Plus

Any organisation bidding for NHS or wider UK public-sector contracts.

The UK government-backed scheme. Cyber Essentials is self-assessed; Cyber Essentials Plus adds independent technical verification — the level procurement teams actually look for. One of the highest-priority certifications to keep current for any NHS relationship.

DTAC

Digital health tools being deployed into the NHS.

NHS England's Digital Technology Assessment Criteria, covering clinical safety, data protection, technical security, interoperability and usability. Not a one-off certificate: it must be maintained and evidenced for each NHS deployment.

DSPT

England's annual self-assessment against the National Data Guardian's 10 data security standards. Mandatory for any organisation handling NHS patient data, with a submission deadline of 30 June each year. Organisations assessed at a higher tier need an independent external audit to validate their submission. Periculo provides this independent DSPT audit as a standalone service.

HDS

Anyone hosting French patient data.

Hébergeur de Données de Santé, legally mandatory under French law. Hosting via an already-certified provider (e.g. Azure France Central) is the fastest route; building from scratch typically takes 6–12 months.

BSI C5 Type 2

Cloud services used by German hospitals and statutory health insurers.

Type 1 is not sufficient for production use. Type 2 requires a six-month observation period followed by an audit. A hard requirement for any German hospital customer.

ENS (Esquema Nacional de Seguridad)

(Esquema Nacional de Seguridad) Required for the Spanish public health sector, at Medium or High level depending on system classification, under Royal Decree 311/2022. Requires a CCN-accredited auditor, renews every two years, and typically takes 6–18 months to achieve.

NEN 7510

Organisations connecting to Dutch health infrastructure.

The Dutch equivalent of ISO 27001 with added healthcare-specific requirements. For ISO 27001 holders it is usually a 3–6 month add-on, with annual surveillance thereafter.

ACH Cloud QC2

Services connecting to the Italian national health service (SSN/ASL).

The fastest route is via an ACN-qualified cloud provider. Builds on ISO 27001 plus ISO 27017/27018.

Inera Certification

Services connecting to Swedish health systems (NPÖ, Pascal, SITHS, 1177).

Involves SITHS eID authentication. Best approached with a Swedish healthcare IT specialist.

MedCom Certification 

HL7 FHIR data exchange within the Danish healthcare system.

Uses MOCES/FOCES certificates. Best approached with a Danish healthcare IT specialist.

NHN Compliance 

Services connecting to the Norwegian Health Network.

A self-declaration route is quicker; a third-party audit takes longer. As an EEA member, Norway also applies EU MDR and GDPR in full.

Kanta Services

Services connecting to the Finnish Patient Data Repository and e-prescription system.

Uses HL7 CDA R2/FHIR and requires audit by Kela and THL.

Belgian eHealth Platform

Data exchange with Belgian hospitals.

Uses eID, eHealth certificates and the HL7 BE Profile. Best approached with a Belgian eHealth specialist.