The essentials
"Being in the cloud" or handling medical information is not enough to qualify an HDS scope. You must document the nature of the data, the circumstances of its collection, the service provided, the role of each actor and the activities actually operated.
1. Describe the service before the provider
The first scope sheet must follow the data's journey: collection, transmission, retention, administration, backup, support access and restitution. It names the entity from which the data originates and the entity on whose behalf each activity is performed.
2. Check the certificate in detail
A provider's HDS logo is not enough. You must check the certificate's validity, its holder, the sites and services covered, the certified activities and the fit with the architecture actually consumed. The same verification applies to subcontractors down the chain.
The contract must make readable the roles, the locations, the security measures, the notifications, the controls, continuity, reversibility and changes of subcontractor.
3. Connect compliance and operations
The expected evidence is born of real running: entitlement reviews, usable logs, patches, restore tests, incident management and continuity exercises. A documentary file without these operational results remains fragile.
4. Prepare the architecture decisions
- Map components, flows, administrative access and locations.
- Isolate the responsibilities between software vendor, managed-services provider and host.
- Evaluate encryption, key management, identity and traceability.
- Test backup, recovery, export and erasure.
- Organise the monitoring of certificates and scope changes.
5. The expected deliverable of a framing exercise
The useful output is an activities–actors–certificates matrix, together with the contractual and technical gaps, the assumptions to confirm and a prioritised trajectory. It then makes it possible to consult a host or audit a service on a stable scope.