Medical Device Cybersecurity Principles
Safety is critical to the medical technology industry, and medical device manufacturers takeseriously the need to continuously assess the security of their devices in a world where the risks,
no matter how remote, evolve. Medical device manufacturers make every effort to address
cybersecurity throughout the product lifecycle, including during the design, development,production, distribution, deployment, maintenance and disposal of the device and associateddata. Similarly, manufacturers implement proactive measures to manage medical device
cybersecurity, including but not limited to routine device cyber maintenance, assessing
postmarket information, employing risk-based approaches to characterizing vulnerabilities, andtimely implementation of necessary actions.
This document provides the medical device industry’s foundational principles for building acybersecurity program for the development and deployment of secure medical devices. To besure, the entire health care ecosystem that uses advanced medical technologies should be awareof the potential for cybersecurity incidents and share in the commitment to securing thesetechnologies. This includes but is not limited to the users, healthcare professionals, providers, ITsystem integrators, Health IT developers, IT vendors, medical device manufacturers, andregulators. Moreover, security requirements for medical devices must take into account theintended use and use environment of the product. For example, many medical devices arerequired to be immediately accessible by a physician during an emergency medical procedure,
and miniaturized medical devices are often constrained by limited energy storage (e.g., batterylife).
The following foundational principles should guide the development of an effectivecybersecurity program for the production and deployment of secure medical devices:
1. Medical device development and security risk management. An effective
cybersecurity risk management program should incorporate both premarket andpostmarket lifecycle phases and address cybersecurity from medical device conception todisposal. Medical device security risks should be addressed through a risk management
process that is based on consensus-driven recognized standards and reference documents.
a. Manufacturers should address and document cybersecurity during the design anddevelopment of the medical device. In addition to patient safety and device
effectiveness, product development processes must address privacy concerns as wellas the fundamental objectives of secure design: Confidentiality, integrity (including
authenticity and non-repudiation), and availability.

b. Manufacturers should work with healthcare providers, device users and patients toensure that risk control measures intended to increase security do not degrade theintended use of the device, including requirements related to emergency access. A
risk-benefit analysis may be required in certain situations. In many cases, thetherapeutic benefits of a product far outweigh potential security risks.
c. Manufacturers should have a process to monitor the ongoing security of their devices
and if new vulnerabilities are revealed, they must determine whether additional
security risk control measures can be implemented without compromising the safety
and effectiveness of the device.
d. Manufacturers should employ mechanisms to receive relevant cybersecurity-related
information from their suppliers.
2. System-level 1 security. Systems are only as secure as their weakest point. In order tomaintain system-level security, all elements of the system must be appropriately managed
and secured.
a. System-level security is a shared responsibility. Device manufacturers play animportant role; however, all stakeholders within the larger system must work together
to ensure its integrity.
b. Security incidents should be investigated in a collaborative fashion in order to, as
appropriate, uncover facts, appropriately inform stakeholders including patients,
health care delivery organizations, and regulators, and to employ additional security
risk control measures when appropriate in the context of a device’s intended use.
3. Coordinated disclosure. Medical device manufacturers should support a coordinateddisclosure process that provides a pathway for researchers and others to submit
information, including detected potential vulnerabilities, to the organization.
a. Coordinated disclosure processes should clearly define the responsibilities of both themanufacturer and researcher.
b. Manufacturers bear a responsibility to address submitted potential vulnerabilities in atimely and professional manner and to comply with local regulatory reporting
requirements.
c. To minimize any potential impact to patient safety, researchers and other third parties
should work with and submit as promptly as possible, and prior to public release ofsuch information, potential vulnerabilities to the manufacturer and relevant
government body on a coordinated basis.

1

System-level security refers to the architecture, policy and processes that ensure data and systemsecurity in systems that contain connected medical devices.
2

4. Consensus standards, regulatory requirements, and education. The development ofconsensus standards and regulations should be a collaborative effort between regulators,
medical device manufacturers, independent security experts, academia, and health caredelivery organizations.
a. The health care industry should leverage the experiences and expertise of othersectors and government agencies.
b. The involvement of academia and independent security experts is a critical factor inensuring that new standards and regulations are current and reflect best practices.
c. Manufacturers and health care delivery organizations should leverage principles
elaborated in relevant consensus standards and technical reports.
d. Stakeholders should be educated on the importance of coordinating privacy andsecurity requirements so that they complement each other to further patient safety.

3