Cyber Risk Assessments for Medical Devices

Risk Assessment Methodology

Threat Modeling: Identifying What Could Go Wrong Before It Does

Threat modeling is the systematic identification of potential attack paths against a medical device or system. For FDA submissions, threat modeling demonstrates that the manufacturer has analyzed the device's attack surface and identified the cybersecurity threats that could lead to device compromise or misuse. FDA's 2023 cybersecurity guidance references threat modeling as an expected element of premarket cybersecurity documentation, and reviewers look for evidence that the threat model is comprehensive — covering network interfaces, software components, physical access paths, and the clinical environment in which the device will be deployed.

STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) is the most widely applicable threat modeling framework for medical devices. STRIDE analysis systematically evaluates each component of the device architecture against each threat category, producing a structured enumeration of threats that drives the subsequent risk assessment and security control selection. We apply STRIDE in the context of the device's specific clinical use case — the consequences of a Denial of Service attack on a ventilator controller differ fundamentally from those affecting a fitness tracker, and the risk assessment must reflect that clinical context.

Vulnerability Assessment and CVSS Scoring

Vulnerability assessment evaluates the identified threats against the device's SBOM and software architecture to identify known and potential vulnerabilities. The Common Vulnerability Scoring System (CVSS) provides a standardized numerical score for vulnerability severity, enabling prioritization of remediation efforts. For medical devices, CVSS scores must be contextualized: a CVSS high-severity vulnerability in a software component that has no user-accessible attack vector in the device's deployment context presents lower residual risk than the raw CVSS score implies. Documenting this contextualization is part of the cybersecurity risk assessment that FDA reviewers evaluate.

IEC 62443, the international standard for industrial automation and control system security, provides a framework increasingly referenced in FDA guidance and adopted in medical device cybersecurity programs. The standard's Security Level (SL) targeting and security control requirements provide a structured approach to cybersecurity risk management that maps to the ISO 14971 risk management process device manufacturers already use for physical safety risks.

Residual Risk and the FDA Cybersecurity Risk Acceptance

Not all cybersecurity risks can be completely mitigated. Residual cybersecurity risk — risk that remains after security controls have been implemented — must be documented and evaluated for acceptability in the context of the device's overall benefit-risk profile. FDA expects manufacturers to demonstrate that residual cybersecurity risks are reasonable in light of the device's clinical benefits, and to document the basis for residual risk acceptance. The cybersecurity risk management file connects the threat model, vulnerability assessment, control implementation, and residual risk documentation into a defensible record of the manufacturer's cybersecurity risk management process.

What We Deliver

• Threat model: attack surface analysis, STRIDE or equivalent methodology
• Vulnerability assessment: SBOM-based known vulnerability scan with CVSS scoring
• Risk assessment report: threat-to-impact linkage with clinical safety contextualization
• Security control mapping: controls implemented to address identified threats
• Residual risk documentation and acceptability justification
• Cybersecurity risk management file development (ISO 14971 parallel structure)
• IEC 62443 Security Level analysis and gap assessment
• Cybersecurity risk assessment summary for 510(k) or PMA submission

Assess Your Cyber Risk