How Ziwit supports you on CaRE
In addition to our services, Ziwit is also the publisher of the HTTPCS platform, dedicated to continuous security monitoring, exposure analysis, and vulnerability detection. This platform can be integrated into the CaRE roadmap to enhance visibility over attack surfaces, support audits, and provide actionable indicators for IT and CISO teams.
At Ziwit, our CaRE approach is deliberately operational and evidence-driven. The goal is not to produce theoretical or purely documentary compliance, but to concretely secure the information system and demonstrate that the institution knows how to detect, resist, and recover after a cyber incident.
CaRE technical audits (D1): Internet exposure and Active Directory
We perform technical audits and hardening missions aligned with CaRE expectations and ANSSI practices. For Internet exposure, we cover mapping of exposed services, configuration of equipment and applications, authentication mechanisms, remote access, TLS encryption, and commonly exploited healthcare attack vectors.
On Active Directory, we address overall hygiene, privilege management, GPOs, attack paths, trust relationships, and reduction of lateral movement capabilities. These audits follow a measured progression and prioritized remediation approach.
Ziwit is ANSSI PASSI certified, enabling us to deliver recognized penetration tests and security audits adapted to hospital environments and compliant with regulatory requirements.
BCP / DRP, BIA, PCRA: turning requirements into real capability
Our BCP/DRP support always begins with a risk analysis based on the EBIOS Risk Manager method, to identify the most critical cyber threat scenarios for the institution (ransomware, privileged identity compromise, prolonged EHR unavailability, loss of medico-technical services, etc.). This step directly links care and business challenges to real IT dependencies.
Based on this, we conduct a critical review of existing materials (BCP/DRP documentation, IT procedures, technical DRPs, backups, outsourcing contracts), then update or draft an operational BCP/DRP, structured by scenarios with realistic RTO/RPO objectives.
Our BCP/DRP specificity lies in a focus on real recovery capability: integration of application dependencies, consideration of identities and directories, coordination with critical service providers, and restoration and recovery testing to move from documentation to an actionable crisis runbook. We also support BIA rollout and progressive construction of the framework PCRA, in line with CaRE milestones.
SOC & incident response: reducing time between intrusion and reaction
Within CaRE, the ability to detect and respond quickly is a key factor in reducing impact. Our SOC offering is based on an integrated approach combining SOC, CTI, and CSIRT, covering the entire chain from anticipation to remediation.
The Ziwit SOC includes a Cyber Threat Intelligence (CTI) unit monitoring threats targeting the healthcare sector (ransomware, phishing campaigns, opportunistic APTs), and a CSIRT capable of supporting incident response from investigation through crisis management.
Our SOC is vendor-agnostic: we integrate with existing tools (SIEM, EDR, probes, firewalls, IAM) without vendor lock-in, leveraging existing investments and avoiding technology sprawl. Support is continuous, with indicators, regular reviews, and a continuous improvement logic for detection and response posture.
Awareness, crisis exercises, and maturity uplift
Phishing is often the entry point, but impact depends on human and organizational response. We design targeted awareness programs (clinical staff, administrative teams, IT, executive management) aligned with real-world usage and threat scenarios.
We also support institutions in preparing and running cybersecurity crisis exercises in line with CaRE requirements, to test governance, internal and external communication, and partner coordination. The objective is to turn exercises into a lever for continuous maturity improvement, integrated into the QIP.
Ziwit Consultancy ServicesManual audits and Pentests on-site or remotely
