MDS
オプティメⅡ

2024-04-26 Pub. No.: S0070-0

Manufacturer Disclosure Statement for Medical Device Security -- MDS2
MDS2 statement for DXR-50

PaloDEx Group OY

Question ID

Question

DOC-1
DOC-2
DOC-3
DOC-4
DOC-5

Manufacturer Name
Device Description
Device Model
Document ID
Manufacturer Contact Information
Intended use of device in network-connectedenvironment:
Document Release Date
Coordinated Vulnerability Disclosure: Does the
manufacturer have a vulnerability disclosure program
for this device?
ISAO: Is the manufacturer part of an Information
Sharing and Analysis Organization?

DOC-6
DOC-7

DOC-8
DOC-9

DOC-10
DOC-11
DOC-11.1
DOC-11.2
DOC-11.3
DOC-11.4

See note
PaloDEx Group OY
Dental intra oral imaging device
DXR-50
MDS2 statement for DXR-50+358 10 270 2000
Image acquisition of dental intra
oral imaging
3/25/2024____
Commercial name: DIGORA Optime
__
__

No

__

No

__

Diagram: Is a network or data flow diagram available
that indicates connections to other systemcomponents or expected external resources?
Yes
SaMD: Is the device Software as a Medical Device (i.e.
software-only, no hardware)?
No
Does the SaMD contain an operating system?
N/A
Does the SaMD rely on an owner/operator provided
operating system?
N/A
Is the SaMD hosted by the manufacturer?
Is the SaMD hosted by the customer?

25-Mar-2024____

Note 1
__
__
__

N/A
N/A

__

Yes

__

Yes

Patient name, patient dental x-ray raw image

MANAGEMENT OF PERSONALLY IDENTIFIABLE INFORMATION

MPII-1
MPII-2

MPII-2.1
MPII-2.2

MPII-2.3
MPII-2.4

MPII-2.5

MPII-2.6

MPII-2.7

MPII-2.8

MPII-2.9

MPII-3

Can this device display, transmit, store, or modify
personally identifiable information (e.g. electronic
Protected Health Information (ePHI))?
Does the device maintain personally identifiable
information?

Does the device maintain personally identifiable
information temporarily in volatile memory (i.e., until
cleared by power-off or reset)?
Yes
Does the device store personally identifiable
information persistently on internal media?
No
Is personally identifiable information preserved in thedevice’s non-volatile memory until explicitly erased? No
Does the device store personally identifiable
information in a database?
No
Does the device allow configuration to automaticallydelete local personally identifiable information after
it is stored to a long term solution?
Does the device import/export personally identifiable
information with other systems (e.g., a wearable
monitoring device might export personallyidentifiable information to a server)?
Does the device maintain personally identifiable
information when powered off, or during power
service interruptions?
Does the device allow the internal media to be
removed by a service technician (e.g., for separate
destruction or customer retention)?
Does the device allow personally identifiable
information records be stored in a separate locationfrom the device’s operating system (i.e. secondaryinternal drive, alternate drive partition, or remotestorage location)?
Does the device have mechanisms used for thetransmitting, importing/exporting of personallyidentifiable information?

__
__

__
__

N/A

__

Yes

__

No

__

N/A

No PII data in non-volatile memory

No

Yes

__

MDS2 statement for DXR-50

PaloDEx Group OY

25-Mar-2024

MPII-3.1

Does the device display personally identifiable
information (e.g., video display, etc.)?

Yes

__

MPII-3.2

Does the device generate hardcopy reports or images
containing personally identifiable information?
No__

MPII-3.3

MPII-3.4

MPII-3.5

MPII-3.6

MPII-3.7
MPII-3.8

Does the device retrieve personally identifiable
information from or record personally identifiable
information to removable media (e.g., removableHDD, USB memory, DVD-R/RW,CD-R/RW, tape, CF/SD
card, memory stick, etc.)?
No
Does the device transmit/receive or import/export
personally identifiable information via dedicatedcable connection (e.g., RS-232, RS-423, USB, FireWire,etc.)?
No
Does the device transmit/receive personallyidentifiable information via a wired network
connection (e.g., RJ45, fiber optic, etc.)?
Yes
Does the device transmit/receive personallyidentifiable information via a wireless network
connection (e.g., WiFi, Bluetooth, NFC, infrared,
cellular, etc.)?
No
Does the device transmit/receive personallyidentifiable information over an external network(e.g., Internet)?
No
Does the device import personally identifiable
information via scanning a document?
No

Does the device transmit/receive personallyidentifiable information via a proprietary protocol?
Does the device use any other mechanism totransmit, import or export personally identifiable
MPII-3.10
information?
Management of Private Data notes:
MPII-3.9

__

__

__

__

__

Yes

Note 2No__

ALOF-1

Can the device be configured to force reauthorizationof logged-in user(s) after a predetermined length ofinactivity (e.g., auto-logoff, session lock, password
protected screen saver)?
No__

ALOF-2Is the length of inactivity time before autologoff/screen lock user or administrator configurable? No__

AUTOMATIC LOGOFF The device's ability to prevent access and misuse byunauthorized users if device is left idle for a period of(ALOF)time.

AUDIT CONTROLS(AUDT)

AUDT-1
AUDT-1.1
AUDT-1.2

AUDT-2
AUDT-2.1
AUDT-2.2
AUDT-2.3
AUDT-2.4
AUDT-2.5
AUDT-2.6
AUDT-2.7

The ability to reliably audit activity on the device.

Can the medical device create additional audit logs orreports beyond standard operating system logs?
Yes
Does the audit log record a USER ID?
N/ADoes other personally identifiable information exist in
the audit trail?
No
Are events recorded in an audit log? If yes, indicate
which of the following events are recorded in theaudit log:
No
Successful login/logout attempts?
N/A
Unsuccessful login/logout attempts?
N/A
Modification of user privileges?
N/A
Creation/modification/deletion of users?
N/A
Presentation of clinical or PII data (e.g. display, print)? No
Creation/modification/deletion of data?
No
Import/export of data from removable media (e.g.
USB drive, external hard drive, DVD)?
N/A

Internal error, warning and service logs.
__

__
__
__
__
__
__
__
__

MDS2 statement for DXR-50

PaloDEx Group OY

AUDT-2.8
AUDT-2.8.1
AUDT-2.8.2
AUDT-2.9
AUDT-2.10
AUDT-2.11
AUDT-3
AUDT-4
AUDT-4.1
AUDT-4.1.1
AUDT-5
AUDT-5.1
AUDT-5.2
AUDT-5.3
AUDT-5.4
AUDT-6
AUDT-7
AUDT-7.1
AUDT-8AUTHORIZATION(AUTH)

AUTH-1

AUTH-1.1
AUTH-1.2
AUTH-1.3

AUTH-2AUTH-3AUTH-4
AUTH-5CYBER SECURITY
PRODUCTUPGRADES (CSUP)

CSUP-1
CSUP-2

CSUP-2.1

Receipt/transmission of data or commands over a
network or point-to-point connection?
No
Remote or on-site support?
No
Application Programming Interface (API) and similar
activity?
Yes
Emergency access?
N/A
Other events (e.g., software updates)?
No
Is the audit capability documented in more detail?
No
Can the owner/operator define or select which events
are recorded in the audit log?
No
Is a list of data attributes that are captured in theaudit log for an event available?
No
Does the audit log record date/time?
No
Can date and time be synchronized by Network Time
Protocol (NTP) or equivalent time source?
Yes
Can audit log content be exported?
Yes
Via physical media?
No
Via IHE Audit Trail and Node Authentication (ATNA)
profile to SIEM?
No
Via Other communications (e.g., external service
device, mobile applications)?
Yes
Are audit logs encrypted in transit or on storage
media?
No
Can audit logs be monitored/reviewed byowner/operator?
Yes
Are audit logs protected from modification?
No
Are audit logs protected from access?
No
Can audit logs be analyzed by the device?
No
The ability of the device to determine theauthorization of users.
Does the device prevent access to unauthorized users
through user login requirements or othermechanism?
Can the device be configured to use federated
credentials management of users for authorization(e.g., LDAP, OAuth)?
Can the customer push group policies to the device(e.g., Active Directory)?
Are any special groups, organizational units, or group
policies required?
Can users be assigned different privilege levels based
on 'role' (e.g., user, administrator, and/or service,etc.)?
Can the device owner/operator grant themselves
unrestricted administrative privileges (e.g., access
operating system or application via local root oradministrator account)?
Does the device authorize or control all API accessrequests?
Does the device run in a restricted access mode, or‘kiosk mode’, by default?

25-Mar-2024

__
__
__
__
__
__

__
__
__
__
__
__
Download logs to workstation from device
__
__
__
__

No

__

N/A

__

N/A

__

N/A

__

No

__

No

__

No

__

Yes

__

The ability of on-site service staff, remote service
staff, or authorized customer staff to install/upgrade
device's security patches.
Does the device contain any software or firmware
which may require security updates during its
operational life, either from the device manufacturer
or from a third-party manufacturer of thesoftware/firmware? If no, answer “N/A” to questionsin this section.
Yes
Does the device contain an Operating System? If yes,complete 2.1-2.4.
No
Does the device documentation provide instructions
for owner/operator installation of patches orsoftware updates?
N/A

__
__

__

PaloDEx Group OY

CSUP-2.2

MDS2 statement for DXR-50

Does the device require vendor or vendor-authorized
service to install patches or software updates?
N/A

CSUP-3.1

Does the device have the capability to receive remote
installation of patches or software updates?
N/A
Does the medical device manufacturer allow security
updates from any third-party manufacturers (e.g.,
Microsoft) to be installed without approval from the
manufacturer?
N/A
Does the device contain Drivers and Firmware? If yes,complete 3.1-3.4.
Yes
Does the device documentation provide instructions
for owner/operator installation of patches orsoftware updates?
Yes

CSUP-3.2

Does the device require vendor or vendor-authorized
service to install patches or software updates?
Yes

CSUP-2.3

CSUP-2.4
CSUP-3

CSUP-4.1

Does the device have the capability to receive remote
installation of patches or software updates?
No
Does the medical device manufacturer allow security
updates from any third-party manufacturers (e.g.,
Microsoft) to be installed without approval from the
manufacturer?
No
Does the device contain Anti-Malware Software? If
yes, complete 4.1-4.4.
No
Does the device documentation provide instructions
for owner/operator installation of patches orsoftware updates?
N/A

CSUP-4.2

Does the device require vendor or vendor-authorized
service to install patches or software updates?
N/A

CSUP-3.3

CSUP-3.4
CSUP-4

CSUP-5.1

Does the device have the capability to receive remote
installation of patches or software updates?
N/A
Does the medical device manufacturer allow security
updates from any third-party manufacturers (e.g.,
Microsoft) to be installed without approval from the
manufacturer?
N/A
Does the device contain Non-Operating Systemcommercial off-the-shelf components? If yes,complete 5.1-5.4.
Yes
Does the device documentation provide instructions
for owner/operator installation of patches orsoftware updates?
No

CSUP-5.2

Does the device require vendor or vendor-authorized
service to install patches or software updates?
N/A

CSUP-4.3

CSUP-4.4

CSUP-5

CSUP-6.1

Does the device have the capability to receive remote
installation of patches or software updates?
No
Does the medical device manufacturer allow security
updates from any third-party manufacturers (e.g.,
Microsoft) to be installed without approval from the
manufacturer?
No
Does the device contain other software components(e.g., asset management software, license
management)? If yes, please provide details orrefernce in notes and complete 6.1-6.4.
No
Does the device documentation provide instructions
for owner/operator installation of patches orsoftware updates?
N/A

CSUP-6.2

Does the device require vendor or vendor-authorized
service to install patches or software updates?
N/A

CSUP-5.3

CSUP-5.4

CSUP-625-Mar-2024

__

__

__
__

__

__

__

__
__

__

__

__

__

__
Device software is updated by service technician. No
patches supported.

__

__

__

__

__

__

MDS2 statement for DXR-50

PaloDEx Group OY

CSUP-6.3

CSUP-6.4
CSUP-7
CSUP-8

CSUP-9

CSUP-10
CSUP-10.1
CSUP-11
CSUP-11.1
CSUP-11.2

HEALTH DATA DEIDENTIFICATION(DIDT)
DIDT-1

DIDT-1.1

Does the device have the capability to receive remote
installation of patches or software updates?
N/A
Does the medical device manufacturer allow security
updates from any third-party manufacturers (e.g.,
Microsoft) to be installed without approval from the
manufacturer?
N/A
Does the manufacturer notify the customer when
updates are approved for installation?
No
Does the device perform automatic installation ofsoftware updates?
No
Does the manufacturer have an approved list of thirdparty software that can be installed on the device?
N/A
Can the owner/operator install manufacturerapproved third-party software on the device
themselves?
No
Does the system have mechanism in place to prevent
installation of unapproved software?
N/A
Does the manufacturer have a process in place toassess device vulnerabilities and updates?
No
Does the manufacturer provide customers withreview and approval status of updates?
N/A
Is there an update review cycle for the device?
N/A

25-Mar-2024____
No automatic indications of update needs.
__

__

__
__
__
__
__

The ability of the device to directly remove
information that allows identification of a person.
Does the device provide an integral capability to deidentify personally identifiable information?
No
Does the device support de-identification profiles thatcomply with the DICOM standard for deidentification?
N/A

__

__

DATA BACKUP AND The ability to recover after damage or destruction of
DISASTER RECOVERY device data, hardware, software, or site configuration(DTBK)
information.

DTBK-1

DTBK-2
DTBK-3
DTBK-4

DTBK-5
DTBK-6

Does the device maintain long term primary storageof personally identifiable information / patient
information (e.g. PACS)?
Does the device have a “factory reset” function to
restore the original device settings as provided by the
manufacturer?
Does the device have an integral data backup
capability to removable media?
Does the device have an integral data backup
capability to remote storage?
Does the device have a backup capability for system
configuration information, patch restoration, andsoftware restoration?
Does the device provide the capability to check the
integrity and authenticity of a backup?

No

__

Yes

__

No

__

No

No
No

EMERGENCY ACCESS
The ability of the device user to access personally(EMRG)EMRG-1HEALTH DATAINTEGRITY AND
AUTHENTICITY(IGAU)

identifiable information in case of a medical
emergency situation that requires immediate accessto stored personally identifiable information.
Does the device incorporate an emergency access (i.e.
“break-glass”) feature?
N/A
How the device ensures that the stored data on thedevice has not been altered or destroyed in a nonauthorized manner and is from the originator.

No PII is stored in the device.

MDS2 statement for DXR-50

PaloDEx Group OY

IGAU-1

IGAU-2

Does the device provide data integrity checking
mechanisms of stored health data (e.g., hash ordigital signature)?
Does the device provide error/failure protection andrecovery mechanisms for stored health data (e.g.,
RAID-5)?

25-Mar-2024

No

__

N/A

Device does not store data permanently.

The ability of the device to effectively prevent, detect
and remove malicious software (malware).
MALWARE
DETECTION/PROTECTION (MLDP)
MLDP-1

MLDP-2.5

Is the device capable of hosting executable software? No
Does the device support the use of anti-malware
software (or other anti-malware mechanism)?
Provide details or reference in notes.
No
Does the device include anti-malware software by
default?
N/A
Does the device have anti-malware software available
as an option?
N/A
Does the device documentation allow theowner/operator to install or update anti-malware
software?
N/A
Can the device owner/operator independently (re)configure anti-malware settings?
N/A
Does notification of malware detection occur in thedevice user interface?
N/A

MLDP-2.6
MLDP-2.7

Can only manufacturer-authorized persons repair
systems when malware has been detected?
Are malware notifications written to a log?

N/A
N/A

MLDP-2.8

Are there any restrictions on anti-malware (e.g.,purchase, installation, configuration, scheduling)?

N/A

MLDP-3

If the answer to MLDP-2 is NO, and anti-malware
cannot be installed on the device, are othercompensating controls in place or available?

No__

Does the device employ application whitelisting that
restricts the software and services that are permitted
to be run on the device?
No
Does the device employ a host-based intrusion
detection/prevention system?
No__

MLDP-2MLDP-2.1
MLDP-2.2

MLDP-2.3
MLDP-2.4

MLDP-4MLDP-5MLDP-5.1
MLDP-5.2

NODE
AUTHENTICATION(NAUT)Can the host-based intrusion detection/prevention
system be configured by the customer?
Can a host-based intrusion detection/prevention
system be installed by the customer?

NAUT-3

The ability of the device to authenticate
communication partners/nodes.
Does the device provide/support any means of node
authentication that assures both the sender and therecipient of data are known to each other and are
authorized to receive transferred information (e.g.
Web APIs, SMTP, SNMP)?
Are network access control mechanisms supported(E.g., does the device have an internal firewall, or use
a network connection white list)?
Is the firewall ruleset documented and available forreview?
Does the device use certificate-based network
connection authentication?

CONNECTIVITYCAPABILITIES(CONN)All network and removable media connections must
be considered in determining appropriate security
controls. This section lists connectivity capabilities
that may be present on the device.

NAUT-1

NAUT-2NAUT-2.1

__

__
__
__

__
__

__

N/A

__

N/A

__

No

__

No

__

N/A

Note 3

No__

MDS2 statement for DXR-50

PaloDEx Group OY

CONN-1.1.3

Does the device have hardware connectivity
capabilities?
Does the device support wireless connections?
Does the device support Wi-Fi?
Does the device support Bluetooth?
Does the device support other wireless network
connectivity (e.g. LTE, Zigbee, proprietary)?

CONN-1.1.4
CONN-1.2

Does the device support other wireless connections(e.g., custom RF controls, wireless detectors)?
Does the device support physical connections?

CONN-1
CONN-1.1
CONN-1.1.1
CONN-1.1.2

CONN-1.2.1
CONN-1.2.2
CONN-1.2.3
CONN-1.2.4

CONN-2
CONN-3

CONN-4
CONN-5
CONN-6
CONN-7
CONN-7.1

CONN-8PERSONAUTHENTICATION(PAUT)

25-Mar-2024

Yes
No
No
No

Note 4
__
__
__

No

__

No
Yes

__
__

Yes
No

__

No

__

Does the device support other physical connectivity? No
Does the manufacturer provide a list of network ports
and protocols that are used or may be used on thedevice?
Yes
Can the device communicate with other systems
within the customer environment?
Yes
Can the device communicate with other systems
external to the customer environment (e.g., a service
host)?
No
Does the device make or receive API calls?
No
Does the device require an internet connection for its
intended use?
No
Does the device support Transport Layer Security(TLS)?
No
Is TLS configurable?
No
Does the device provide operator control
functionality from a separate device (e.g.,telemedicine)?
Yes__

Does the device have available RJ45 Ethernet ports?
Does the device have available USB ports?
Does the device require, use, or support removable
memory devices?

Note 4Note 5__Note 5____Note 5The ability to configure the device to authenticate
users.

PAUT-7

Does the device support and enforce unique IDs andpasswords for all users and roles (including service
accounts)?
Does the device enforce authentication of unique IDs
and passwords for all users and roles (including
service accounts)?
Is the device configurable to authenticate users
through an external authentication service (e.g., MS
Active Directory, NDS, LDAP, OAuth, etc.)?
Is the device configurable to lock out a user after acertain number of unsuccessful logon attempts?
Are all default accounts (e.g., technician service
accounts, administrator accounts) listed in the
documentation?
Can all passwords be changed?
Is the device configurable to enforce creation of user
account passwords that meet established(organization specific) complexity rules?
Does the device support account passwords that
expire periodically?

N/A

__

PAUT-8
PAUT-9Does the device support multi-factor authentication? N/A
Does the device support single sign-on (SSO)?
N/A

__
__

PAUT-10
PAUT-11Can user accounts be disabled/locked on the device?
Does the device support biometric controls?
Does the device support physical tokens (e.g. badge
access)?

N/A
N/A

__
__

N/A

__

PAUT-1

PAUT-1.1

PAUT-2
PAUT-3

PAUT-4
PAUT-5

PAUT-6

PAUT-12

No

__

N/A

__

N/A

__

N/A

__

N/A
N/A

__
__

N/A

__

MDS2 statement for DXR-50

PaloDEx Group OY

PAUT-13
PAUT-14
PAUT-14.1

PHYSICAL LOCKS(PLOK)

PLOK-1

PLOK-2

PLOK-3

PLOK-4

ROADMAP FOR
THIRD PARTYCOMPONENTS IN
DEVICE LIFE CYCLE(RDMP)

RDMP-1

RDMP-2

RDMP-3
RDMP-4

Does the device support group authentication (e.g.
hospital teams)?
Does the application or device store or manage
authentication credentials?
Are credentials stored using a secure method?
Physical locks can prevent unauthorized users withphysical access to the device from compromising the
integrity and confidentiality of personally identifiable
information stored on the device or on removablemedia
Is the device software only? If yes, answer “N/A” toremaining questions in this section.
Are all device components maintaining personallyidentifiable information (other than removable
media) physically secure (i.e., cannot remove without
tools)?
Are all device components maintaining personallyidentifiable information (other than removable
media) physically secured behind an individually
keyed locking device?
Does the device have an option for the customer toattach a physical lock to restrict access to removable
media?

N/A

__

N/A
N/A

__
__

No

__

Yes

__

No

__

N/A

__

Yes

IEC62304 used

No

__

Yes

Technical bulletins of new software releases.
This is part of manufacturer medical device lice-cycle
management.

Manufacturer’s plans for security support of thirdparty components within the device’s life cycle.

Was a secure software development process, such as
ISO/IEC 27034 or IEC 62304, followed during productdevelopment?
Does the manufacturer evaluate third-party
applications and software components included in
the device for secure development practices?
Does the manufacturer maintain a web page or othersource of information on software support dates andupdates?
Does the manufacturer have a plan for managing
third-party component end-of-life?

Yes

SOFTWARE BILL OF
MATERIALS (SBoM)

A Software Bill of Material (SBoM) lists all thesoftware components that are incorporated into thedevice being described for the purpose of operational
security planning by the healthcare deliveryorganization. This section supports controls in the
RDMP section.

SBOM-1Is the SBoM for this product available?
Yes
Does the SBoM follow a standard or common method
in describing software components?
Yes
Are the software components identified?
Yes
Are the developers/manufacturers of the software
components identified?
Yes
Are the major version numbers of the software
components identified?
Yes

SBOM-2SBOM-2.1
SBOM-2.2
SBOM-2.3
SBOM-2.4

25-Mar-2024

List of commercial of the shelf (COTS) components.
Not public document.
List of commercial of the shelf (COTS) components.
Not public document.
__
__
__

No

__

SBOM-3

Are any additional descriptive elements identified?
Does the device include a command or process
method available to generate a list of software
components installed on the device?

No

SBOM-4Is there an update process for the SBoM?

Yes__This is part of manufacturer's software releaseprocess.

MDS2 statement for DXR-50

PaloDEx Group OY

25-Mar-2024

The device's inherent resistance to cyber attacks and
SYSTEM AND
malware.
APPLICATION
HARDENING (SAHD)
SAHD-1
SAHD-2SAHD-3SAHD-3.1

SAHD-3.2

SAHD-4SAHD-5
SAHD-5.1

Is the device hardened in accordance with any
industry standards?
No
Has the device received any cybersecurity
certifications?
No
Does the device employ any mechanisms for software
integrity checking
Yes
Does the device employ any mechanism (e.g., releasespecific hash key, checksums, digital signature, etc.) toensure the installed software is manufacturerauthorized?
No
Does the device employ any mechanism (e.g., releasespecific hash key, checksums, digital signature, etc.) toensure the software updates are the manufacturerauthorized updates?
No
Can the owner/operator perform software integrity
checks (i.e., verify that the system has not been
modified or tampered with)?
No
Is the system configurable to allow the
implementation of file-level, patient level, or othertypes of access controls?
No

SAHD-11

Does the device provide role-based access controls? No
Are any system or user accounts restricted or disabledby the manufacturer at system delivery?
No
Are any system or user accounts configurable by theend user after initial configuration?
N/A
Does this include restricting certain system or user
accounts, such as service technicians, to leastprivileged access?
N/A
Are all shared resources (e.g., file shares) which are
not required for the intended use of the device
disabled?
N/A
Are all communication ports and protocols that are
not required for the intended use of the device
disabled?
No
Are all services (e.g., telnet, file transfer protocol[FTP], internet information server [IIS], etc.), which
are not required for the intended use of the device
deleted/disabled?
No
Are all applications (COTS applications as well as OSincluded applications, e.g., MS Internet Explorer, etc.)
which are not required for the intended use of thedevice deleted/disabled?
No
Can the device prohibit boot from uncontrolled or
removable media (i.e., a source other than an internal
drive or memory component)?
N/A

SAHD-12Can unauthorized software or hardware be installedon the device without the use of physical tools?

SAHD-6
SAHD-6.1

SAHD-6.2

SAHD-7

SAHD-8

SAHD-9SAHD-10

SHAD-15

Does the product documentation include information
on operational network security scanning by users?
Can the device be hardened beyond the default
provided state?
Are instructions available from vendor for increased
hardening?
Can the system prevent access to BIOS or otherbootloaders during boot?

SAHD-16

Have additional hardening methods not included in
2.3.19 been used to harden the device?

SAHD-13
SAHD-14
SAHD-14.1____
Software binary has checksum.

__

__

__

__
__
__
__

__

__

__

__

__
No boot supported from uncontrolled or removable
media

Yes

__

No

__

No

__

N/A
Yes

Access requires physical tools.

No__MDS2 statement for DXR-50

PaloDEx Group OY

25-Mar-2024

SECURITY GUIDANCE Availability of security guidance for operator andadministrator of the device and manufacturer sales(SGUD)
SGUD-1

SGUD-2
SGUD-3and service.
Does the device include security documentation forthe owner/operator?
No
Does the device have the capability, and provide
instructions, for the permanent deletion of data fromthe device or media?
N/A

__

__

SGUD-3.1

Are all access accounts documented?
Can the owner/operator manage password control
for all accounts?

N/A

__

SGUD-4

Does the product include documentation on
recommended compensating controls for the device? No__

HEALTH DATASTORAGECONFIDENTIALITY(STCF)STCF-1
STCF-1.1
STCF-1.2
STCF-1.3
STCF-2

The ability of the device to ensure unauthorizedaccess does not compromise the integrity andconfidentiality of personally identifiable information
stored on the device or removable media.
Can the device encrypt data at rest?
Is all data encrypted or otherwise protected?
Is the data encryption capability configured bydefault?
Are instructions available to the customer toconfigure encryption?

N/A

__

No
N/A
N/A
N/A

STCF-4

Can the encryption keys be changed or configured?
Is the data stored in a database located on thedevice?
Is the data stored in a database external to thedevice?

TRANSMISSIONCONFIDENTIALITY(TXCF)

The ability of the device to ensure the confidentialityof transmitted personally identifiable information.

TXCF-1

Can personally identifiable information betransmitted only via a point-to-point dedicated cable? Yes

STCF-3

__

N/A

__

No

__

No

__

So called direct connection to workstation is option.

TXCF-3Is personally identifiable information encrypted prior
to transmission via a network or removable media?
If data is not encrypted by default, can the customer
configure encryption options?
Is personally identifiable information transmission
restricted to a fixed list of network destinations?

TXCF-4

Are connections limited to authenticated systems?

No__

TXCF-5

Are secure transmission methods
supported/implemented (DICOM, HL7, IEEE 11073)?

No

__

No

__

No

__

Yes

Via workstation

TXCF-2
TXCF-2.1

TRANSMISSIONINTEGRITY (TXIG)

TXIG-1
TXIG-2REMOTE SERVICE(RMOT)

RMOT-1

The ability of the device to ensure the integrity oftransmitted data.
Does the device support any mechanism (e.g., digital
signatures) intended to ensure data is not modified
during transmission?
Does the device include multiple sub-components
connected by external cables?

No

__

No

__

No

__

Remote service refers to all kinds of device
maintenance activities performed by a service person
via network or other remote connection.
Does the device permit remote service connections
for device analysis or repair?

MDS2 statement for DXR-50

PaloDEx Group OY

RMOT-3

Does the device allow the owner/operator toinitiative remote service sessions for device analysis
or repair?
Yes
Is there an indicator for an enabled and active remotesession?
N/A
Can patient data be accessed or viewed from thedevice during the remote session?
Yes
Does the device permit or use remote service
connections for predictive maintenance data?
Yes
Does the device have any other remotely accessiblefunctionality (e.g. software updates, remotetraining)?
Yes

OTHER SECURITYCONSIDERATIONS(OTHR)NONE

RMOT-1.1
RMOT-1.2
RMOT-1.3
RMOT-2

Notes:

Note 1

Note 2

Note 3Note 4Note 5

Please keep individual notes to one cell. Please use
separate notes for separate information
See EPD-058-001 DTX Studio Driver Cybersecurity
Framework
5.1 Environment Description
5.6 Data Flows and Protocols
See EPD-058-001 DTX Studio Driver Cybersecurity
Framework
5.3 Purpose of connection to the health IT
infrastructure
See EPD-058-001 DTX Studio Driver Cybersecurity
Framework
5.4 Networking Requirements
5.6 Data Flows and Protocols
See EPD-058-001 DTX Studio Driver Cybersecurity
Framework
5.2 Network Ports, Protocols and Services
See EPD-058-001 DTX Studio Driver Cybersecurity
Framework
5.1 Environment Description,
5.3 Purpose of connection to the health IT
infrastructure

25-Mar-2024

Via workstation____
Via workstation

Via workstation