1The case: Démoville University Hospital
Study objective: security accreditation of the clinical information system for HDS health-data hosting certification and NIS2 compliance. The scope is limited to the clinical IS—EHR, PACS, and laboratory—with a six-month budget, an external CISO, and an HDS certification deadline in December. Assumptions: operational daily backups, a level-2 HDS-certified cloud provider, and EHR and PACS hosted in the hospital data centre.
2Atelier 1 — Biens essentiels
Two missions were selected: Patient care (business values: patient health data in the EHR and 24/7 continuity of care; supporting assets: electronic patient record, PACS imaging archive, clinical LAN, and LDAP/Active Directory) and Gestion administrative et RH (HR and payroll data for 2,500 staff).
3Workshop 2—Risk sources
Four of six candidate RS/TO pairs were selected: organised cybercrime seeking financial extortion through ransomware and espionage/data theft, a foreign state seeking espionage, plus two secondary pairs—a malicious employee and malicious provider—placed under monitoring without further development.
4Workshop 3 — Ecosystem and strategic scenarios
The ecosystem map identifies theHDS cloud provider as the most critical stakeholder (dependence 4/4, penetration 4/4, cyber maturity 4/4—in the radar's alert zone), followed by theEHR vendor (high dependence and penetration, lower cyber maturity).
This produces three strategic scenarios, each with one or more attack paths:
| # | Source → Objectif | Chemin d'attaque | Severity |
|---|---|---|---|
| S1 | Organised cybercriminal → Financial extortion | Compromise the EHR vendor's update chain to deploy ransomware through GPO, or target an IT administrator with phishing | 4 — Critique |
| S2 | Organised cybercriminal → Espionage / data theft | Exfiltration through the compromised HDS cloud provider | 3 — Grave |
| S3 | Foreign state → Espionage / data theft | APT targeting genomic-research data through a long-term undetected intrusion | 3 — Grave |
5Workshop 4—Operational scenarios
Strategic scenarios S1 and S2 become two operational scenarios: ransomware through phishing targeting the EHR and PACS (critical severity), and patient-data exfiltration through the compromised EHR vendor, using the HDS cloud provider (Azure Santé) as a stakeholder in the attack path (major severity).
6Atelier 5 — Traitement et pilotage
Four risks are positioned in the severity × likelihood matrix. EHR/PACS ransomware through IT phishing is rated critique and receives a reduction strategy, as do patient-data exfiltration and genomic-data espionage, both moderate. PACS unavailability caused by medical-imaging failure is moderate but unlikely and is instead accepted as is.
7The EBIOS RM report
All data entered in the five workshops is automatically inserted into a complete Word document and structured Excel export, which can be regenerated at any time—not only at the end.
8Learn more
To prepare data before entering it in Polyodos, the scoping sheets below are under construction:
For a complete in-product walkthrough, screen by screen and in the order each workshop is actually completed: Tutoriel Polyodos — Module EBIOS RM.