1300 North 17th Street ▪ Suite 900

Arlington, Virginia 22209

Tel: 703.841.3200

Fax: 703.841.3392

www.medicalimaging.org

10/14/2021

Ms. Katerina N. Megas, et al.

National Institute of Standards and Technology

Applied Cybersecurity Division

Information Technology Laboratory

100 Bureau Drive

Gaithersburg, MD 20899

RE: White Paper (Draft) “Baseline Security Criteria for Consumer IoT Devices”

Dear Ms. Megas:

As the leading trade association representing the manufacturers of medical imaging equipment,

radiopharmaceuticals, contrast media, and focused ultrasound therapeutic devices, the Medical Imaging & 

Technology Alliance (MITA) supports the National Institute of Standards and Technology (NIST) in its 

continued work to enhance cyber resilience. We applaud this draft, “Baseline Security Criteria for 

Consumer IoT Devices,” as an important step towards greater cybersecurity in critical sectors like 

healthcare.

The NIST distinction between consumer IoT devices—as identified in the document title—and other IoT 

device types is welcome, and should be further clarified to highlight the need for any labelling program to 

be suited to its intended purpose. Concrete device examples would also help readers understand the 

spectrum of devices this labelling criteria is intended to cover.

Consumer device labelling programs traditionally provide digestible, easy-to-interpret information to 

assist a consumer who is not expected to hold the expert knowledge nor time available to investigate 

device design. These labels provide value to consumers when the information displayed allows the 

consumer to make a better decision than they could without the label. 

This suggests a distinction between regulated devices, such as medical imaging devices, and unregrulated 

devices, such as wireless printers, is also warranted. As regulated entities, medical imaging device 

manufacturers provide detailed security documentation (e.g., the Manufacturer Disclosure Statement for 

Medical Device Security) to their customers who must evaluate those details in the context of the 

customer’s IT environment. Regulated industries, such as medical imaging device manufacturing, should 

leverage existing labelling practices and processes (e.g., Food & Drug Adminsitration pre-market 

submission requirements) which often exceed the value a consumer labelling program might provide.

We also recommend that NIST consider how other labelling programs—both inside and outside the US—

would interact with and impact each other. NIST should recommend steps toward evaluating, 

harmonizing, and validating other programs to ensure barriers to innovation and competition do not arise.
2

We count on your attention to these comments and offer our services to NIST regarding medical imaging 

device distinctions. For further information, please contact Zack Hornberger, Director of Cybersecurity 

& Informatics, at zhornberger@medicalimaging.org or 703-841-3285.

Sincerely,

Patrick Hope

Executive Director, MITA

MITA is the collective voice of manufacturers of medical imaging equipment, radiopharmaceuticals, 

contrast media, and focused ultrasound therapeutic devices. It represents companies whose sales 

comprise more than 90 percent of the global market for medical imaging innovations. These products

include: magnetic resonance imaging (MRI), medical X-Ray equipment, computed tomography (CT) 

scanners, ultrasound, nuclear imaging, radiopharmaceuticals, and imaging information systems. MITA 

Member company technologies are an important part of our nation’s healthcare infrastructure and are

essential for the screening, diagnosis, staging, managing and effectively treating patients with cancer, 

heart disease, neurological degeneration, and numerous other medical conditions.

CC: Food & Drug Administration