Industry Resources and Tools

The most useful industry resources for medical device cybersecurity are the Joint Security Plan (JSP), MITRE's threat modeling playbook and medical device CVSS rubric, and H-ISAC for threat intelligence sharing. All three are recognized or referenced by FDA, and all are available without buying a standard.

2.7.1 The Joint Security Plan (JSP)

According to the JSP v2.0: "The JSP is not a regulatory document, nor is it a standard. Rather, it is a set of recommendations that may be leveraged across an organization's product portfolio and is intended to be globally applicable."

Key Features:

• Comprehensive framework for product security
• Lifecycle approach from design through retirement
• Practical guidance for implementation
• Industry consensus from multiple stakeholders

2.7.2 MITRE Resources

Threat Modeling Playbook

• Step-by-step threat modeling guidance
• Medical device specific examples
• Multiple methodologies explained

CVSS Rubric for Medical Devices

• FDA-qualified Medical Device Development Tool (MDDT)
• Adapts CVSS for healthcare context
• Considers patient safety impacts
• Standardizes vulnerability scoring

Why MITRE Tools Matter:

• FDA recognizes and references them
• Industry standard approaches
• Free and publicly available
• Regularly updated

2.7.3 Information Sharing Organizations

H-ISAC (Health Information Sharing and Analysis Center)

• Threat intelligence sharing
• Vulnerability alerts
• Best practices
• Peer networking

Benefits of Participation:

• Early warning of threats
• Learn from others' incidents
• Demonstrate proactive approach
• FDA expects participation

Sources

Primary documents named in this section:

1. Common Vulnerability Scoring System (CVSS), FIRST.Org, Inc..
2. Rubric for Applying CVSS to Medical Devices, MITRE.
3. Medical Technology and Health IT Joint Security Plan (JSP), Health Sector Coordinating Council.
4. Health Information Sharing and Analysis Center (Health-ISAC), Health-ISAC.