KRITIS sector.Healthcare.With B3S context.
MailGuard and SecureFiles for facilities above the KRITIS thresholds, with reference to B3S Healthcare and KHZG. EU hosting, ISMS hook, audit log. As of 2026.
KRITIS-fit platform, not an add-on.
- M365 default without a KRITIS layerMailGuard with BEC, QR filter and attachment protection
- DICOM and result bundles as mail attachmentsSecureFiles as a direct line for clinical bundles
- No cross-layer audit logAudit log as a SIEM event
Compliance anchors
Conbool supports the requirements from BSI-KritisV and B3S through technical and organisational measures. KHZG eligibility is project- and audit-specific; the hospital files the application itself.
Four building blocks for hospital IT.
MailGuard as a KRITIS layer, SecureFiles for clinical bundles, SecureMail for peer communication, Disclaimer for required disclosures.
MailGuard
BEC, QR-code phishing, URL reputation and attachment protection at the authentication layer. Audit log as a SIEM event.
MailGuard in detailSecureFilesSecureFiles
DICOM, results and large clinical bundles as a direct line.
SecureFiles in detailSecureMailSecureMail
Encrypted communication to GPs and rehab facilities, with a web reader for recipients without a certificate.
SecureMail in detailDisclaimerDisclaimer
Per-hospital and per-department disclosures applied server-side.
Disclaimer in detailFour scenarios from a working hospital.
From the ED inbox to the rehab handover note.
Catch BEC at administration
CFO impersonations to accounting requesting an early wire are filtered by MailGuard at the authentication layer.
DICOM to private practitioners
Imaging and DICOM bundles flow through SecureFiles as a direct line, beyond Outlook size limits.
Rehab handover
Handover notes and lab results sent to rehab facilities encrypted, with delivery receipts in the audit log.
KRITIS audit trail
Every email action lands in the audit log and is exported via SIEM to the hospital SOC.
Conbool as a KRITIS layer in front of M365.
Conbool sits as an independent layer in front of Microsoft 365 or Exchange. HIS and reporting software remain unchanged.
MX switch
Inbound SMTP runs through Conbool, M365 remains the back-end.
ISMS hook
Configuration is documentable as a technical measure inside the ISMS, with B3S context.
SIEM export
Audit log via standard connector to the hospital SIEM.
Coexistence
Conbool coexists with common HIS, RIS and PACS systems via Outlook and SMTP.
How Conbool maps to B3S Healthcare.
B3S Healthcare defines protection goals for care IT. Conbool covers several measures in the communication-security area.
Confidentiality goal
End-to-end encryption in SecureMail and SecureFiles.
Integrity goal
DMARC-aligned outbound identity, tamper protection in the audit log.
Availability goal
Multi-stage filter and backpressure protection layers for the mail chain.
Evidence
Audit log per GDPR Art. 30 as auditable evidence.
Funding line 10, ISMS and rollout.
Conbool can be listed as a technical measure in the KHZG application. Rollout starts with a pilot tenant and ISMS documentation.
KHZG application
Funding line 10 IT security includes email security. Conbool ships the description of technical measures with the application.
ISMS documentation
Templates for ISMS adoption and measure mapping per B3S.
Pilot tenant
Pilot with one department, then full-house rollout.
Legacy sunset
Existing SEG or filter solution runs in parallel and is replaced step by step.
Frequently asked questions
Is Conbool KRITIS-fit?
How does this fit KHZG funding?
What does ISMS integration look like?
Can we keep using HIS, PACS and RIS?
What about GDPR Art. 9?
What does Conbool cost for hospitals?
Does this work for MVZ groups under a hospital owner?
Verwandte Lösungen
Hornetsecurity-Alternative
Deutsche MailGuard-Alternative nach der Proofpoint-Übernahme.
Phishing-Schutz
BEC, Spear-Phishing und QR-Code-Phishing erkennen und entfernen.
Ransomware-Schutz E-Mail
Mehrstufige Anhang-Filter und URL-Reputation gegen Ransomware-Kampagnen.
Spam-Filter Unternehmen
Spam und unerwünschte Massenmail mit DACH-Heuristiken filtern.
CEO-Fraud-Schutz
BEC und CEO-Fraud-Attacken über Authentifizierungs-Layer abwehren.
Verwandte Branchen
Conbool ist in benachbarten Branchen mit ähnlichem Compliance-Profil im Einsatz.
A KRITIS layer for hospital IT.
Demo in 30 minutes. Pilot in one department. Modular by function.
Sources and date
Statements about KRITIS are based on BSI-KritisV in its respective version. Statements about B3S are based on the BSI sector-specific security requirement for healthcare. Statements about KHZG are based on the German Hospital Future Act and its funding rules. As of 2026.
HIS, RIS and PACS are generic terms in medical informatics. Microsoft, Microsoft 365 and Exchange are trademarks of Microsoft Corporation. Conbool is a trademark of Conbool GmbH.