Industry Resources and Tools

The most useful industry resources for medical device cybersecurity are the Joint Security Plan (JSP), MITRE's threat modeling playbook and medical device CVSS rubric, and H-ISAC for threat intelligence sharing. All three are recognized or referenced by FDA, and all are available without buying a standard.

2.7.1 The Joint Security Plan (JSP)

According to the JSP v2.0: "The JSP is not a regulatory document, nor is it a standard. Rather, it is a set of recommendations that may be leveraged across an organization's product portfolio and is intended to be globally applicable."

Key Features:

• Comprehensive framework for product security
• Lifecycle approach from design through retirement
• Practical guidance for implementation
• Industry consensus from multiple stakeholders

2.7.2 MITRE Resources

Threat Modeling Playbook

• Step-by-step threat modeling guidance
• Medical device specific examples
• Multiple methodologies explained

CVSS Rubric for Medical Devices

• FDA-qualified Medical Device Development Tool (MDDT)
• Adapts CVSS for healthcare context
• Considers patient safety impacts
• Standardizes vulnerability scoring

Why MITRE Tools Matter:

• FDA recognizes and references them
• Industry standard approaches
• Free and publicly available
• Regularly updated

2.7.3 Information Sharing Organizations

H-ISAC (Health Information Sharing and Analysis Center)

• Threat intelligence sharing
• Vulnerability alerts
• Best practices
• Peer networking

Benefits of Participation:

• Early warning of threats
• Learn from others' incidents
• Demonstrate proactive approach
• FDA expects participation