# Integral Security Pillars for Medical Devices:
## 9 Who
### Presentation of the Data and Analysis of the Results
#### 3.3.4 Result of the Analysis of the Information Obtained  
**ISO standards** align with the systematization of information and focus on the management and administration of data, offering guidelines for the implementation of information security. Additionally, a gap was identified between the updating of these standards and technological advancements. **NIST controls** provide a flexible and risk-oriented approach to strengthening cybersecurity in critical infrastructures, particularly in the healthcare sector. One key aspect is the existence of specific guidelines for digital identity management, which is crucial for medical devices that require robust authentication and access control. The **HIPAA Privacy Rule** establishes national standards to protect Protected Health Information (PHI), ensuring its confidentiality and limiting its use and disclosure without patient consent. HIPAA mandates administrative, physical, and technical safeguards to protect electronic PHI, including access controls and encryption. It promotes transparency and accountability in incident management. **ENISA** emphasizes the importance of cybersecurity training and the implementation of restricted access policies in the healthcare sector to prepare staff for cyber threats. It recommends security measures for remote care systems, such as telemedicine, including secure connections and robust authentication. **GDPR** sets out essential principles for the processing of personal data, ensuring that it is lawful, fair, transparent, and limited to specific purposes--factors particularly relevant for medical devices. Additionally, it grants individuals rights over their personal data, such as access, rectification, deletion, and portability, promoting transparency and accountability in data handling. The **HITRUST framework** offers a comprehensive approach to information security risk management by integrating standards such as HIPAA, NIST, ISO, and COBIT. This integration not only facilitates regulatory compliance but also strengthens organizational security, providing confidence that systems are well protected. It is adaptable to different types and sizes of organizations, allowing customization of controls according to specific needs. The scientific literature review spans from 2017 to 2025, showcasing various studies focused on cybersecurity, vulnerabilities, and the detection of attacks in emerging technologies applied to infrastructures, such as blockchain and the IoT. According to the interpretation of the graphs, it is observed that in the last year, the number of scientific articles centered on key topics such as the need for clear regulatory frameworks, the security of critical infrastructure, the characterization of specific attacks, the consideration of  
Figure 5: Number of occurrences of attacks recorded in the analyzed CVEs. human and organizational factors, and the adoption of rigorous analytical methodologies has doubled. This growth reflects an increasing attention towards patterns such as the intensive digitalization of the health sector, cybersecurity as a central axis, and the use of emerging technologies like artificial intelligence, advanced cryptography, and blockchain. Nevertheless, significant gaps persist related to the vulnerabilities of connected devices, the risks derived from interoperability, the challenges in the protection of new technologies, and the weaknesses linked to security culture and staff awareness, aspects that also evidence the urgency of a comprehensive socio-technical approach. Regarding the review of recorded vulnerabilities, a trend is observed in the attacks, most of which are related to remote exploitation and malicious code injection. There is a repetition of similar vulnerabilities in different versions or models from the same manufacturer, which may indicate structural deficiencies in secure development lifecydes. Vulnerabilities that allow low-complexity attacks or remote exploitation represent a high real risk, as they can be easily exploited without the need for advanced tools.