Cybersecurity as a Shared Responsibility

Responsibility for medical device cybersecurity is split across the whole ecosystem. Manufacturers, healthcare facilities, clinicians, and patients each control a different piece of the risk, and none of them can secure a device alone. Both FDA and the Joint Security Plan frame security this way, with defined roles for every stakeholder.

1.5.1 The Ecosystem Approach

According to both the FDA guidance and the Joint Security Plan, "medical device cybersecurity is a shared responsibility among stakeholders." This isn't something any one group can solve alone.

The key stakeholders include:

Manufacturers:

• Design secure devices
• Provide security updates
• Communicate vulnerabilities
• Support customers with security needs

Healthcare Facilities:

• Maintain secure networks
• Apply security updates
• Monitor for threats
• Train staff on security

Healthcare Providers:

• Follow security procedures
• Report suspicious activities
• Protect access credentials
• Maintain physical security

Patients:

• Protect personal devices
• Follow security instructions
• Report concerns
• Keep software updated (for home devices)

1.5.2 Why Shared Responsibility Matters

No single stakeholder can ensure cybersecurity alone because:

1. Manufacturers can't control how devices are used after sale
2. Hospitals can't fix vulnerabilities in device software
3. Clinicians need usable devices to provide care
4. Patients may not understand technical risks

Success requires everyone working together with clear roles and responsibilities.