| 3.1 |
MDCG 2019-16 cpt. 3.2 |
'The security risk management process has the same elements as the safety risk management process, all documented in a security risk management plan. The process elements are security risk analysis, security risk evaluation, security risk control, evaluation of residual security risk and reporting.' |
Is a security risk analysis available? |
Yes, see:- Risk management plan- Risk table- Risk management report |
| 3.2 |
MDCG 2019-16 cpt. 3.4andIEC 81001-5-1 cl. 7.2 |
'Threat Modelling techniques are a systematic approach for analyzing the security of an item in a structural way such that vulnerabilities can be identified, enumerated and prioritized, all from a hypothetical attacker's point of view.'AND'(...) Employ activities to ensure that all products have a threat model specific to the current development scope.' |
Does the security risk assessment contain an appropriate and systematic threat model?Note: STRIDE is a systematic threat modelling technique, since it evaluates threat categories interface by interface. |
Potential cyber security risks and IT-security concerns have been taken into account within the framework of the existing FMEA risk analysis, following the ISO 14971 standard for risk management in medical devices. |
| 3.3 |
MDCG 2019-16 cpt. 3.4 |
'Threat modelling typically employs a systematic approach to identify attack vectors and assets most desired by an attacker.'AND- 'Establish activities which identify and document any vulnerabilities\, threats and associated adverse impacts affecting confidentiality\, integrity\, availability of assets.- Consider intended use and the intended environment of use.' |
Is the threat model complete and correct (e.g. discussing all applicable threats for all relevant attack vectors)? |
Yes, see risk table. |
| 3.4 |
IEC 81001-5-1 cl. 7.3 |
- Establish activities to estimate risk of vulnerabilities.- Risk estimation should consider adverse impact of vulnerability to security- Estimation can be supported by using vulnerability scoring- Scoring system can be based on a likelihood/severity scheme used by the manufacturer for other risks- Evaluate estimated risks- Determine if risk is acceptable or not (based on scoring)- Inform product risk management process |
Is the risk pre- and post-mitigation appropriately estimated?Note 1: quantitative risk assessment is acceptable.Note 2: security risk is a combination of exploitability and severity.Note 3: alteration or disclosure of patient data can lead to harm. |
Yes, see:- Risk table- Risk management report |
| 3.5 |
MDCG 2019-16 cpt. 3.2 |
'When a security risk or control measure could have a possible impact on safety and effectiveness, then it should be included in the safety risk assessment.' |
Are security mitigations (if any) that might affect safety appropriately discussed? |
Yes, see:- Risk table- Risk management report |
| 3.6 |
MDCG 2019-16 cpt. 3.3 |
‘Where there is an impact on safety or effectiveness, manufacturers shall select the most appropriate risk control solution, in the following order of priority:a) Eliminate or reduce risks as far as possible through safe design and manufacture;b) Where appropriate, take adequate protection measures, including alarms if necessary, in relation to risks that cannot be eliminated;c) Provide information for safety (warnings/precautions/contra-indications) and, where appropriate, training to users.For security, a similar approach can be taken:a) Eliminate or reduce security risks as far as feasible through secure design and manufacture;b) Where appropriate, take adequate protection measures, including security notifications if necessary, in relation to risks that cannot be eliminated;c) Provide information for security (warnings/precautions/contra-indications) including information on measures that the user is required to take in the operating environment to reduce the likelihood of exploitation. |
Do risk control solutions have the correct order or priority?Note: according to MDR/IVDR, the auditee shall always implement security measures within the device rather than delegating security via IFU to the user or admin of the device. |
Yes, see:- Risk table- Risk management report |
| 3.7 |
IEC 81001-5-1 cl. 7.4 |
- Determine whether security risk control measures are appropriate for reducing security risks to an acceptable level (based on security risk acceptance policies)- If risk controls are deemed appropriate: appropriate mitigations selected- Determine whether mitigations result in new risks or increased other risks\,- Select mitigations implemented\, effectiveness of the implemented measures verified |
Are risk control measures / counter measures appropriate? |
Yes, see:- Risk table- Risk management report |
| 3.8 |
MDCG 2019-16 cpt. 2.1andMDR Annex I (17.4) / IVDR Annex I (16.4)andMDR Annex I (18.8)andMDR Annex I (17.2) / IVDR Annex I (16.2) |
‘Key concepts involved in IT security specifically for medical devices are the following:- Confidentiality of information at rest and in transit- Integrity\, which is necessary to ensure information authenticity and accuracy (i.e. non-repudiation)- Availability of the processes\, devices\, data\, and connected systems.‘AND‘Manufacturers shall set out minimum requirements concerning hardware, IT networks characteristics and IT security measures, including protection against unauthorised access, necessary to run the software as intended.’AND‘Devices shall be designed and manufactured in such a way as to protect, as far as possible, against unauthorised access that could hamper the device from functioning as intended.’AND'The Cybersecurity risks are as far as possible reduced without adversely affecting the benefit-risk ratio. The device is developed in accordance with the state of the art taking into account the principles of risk management, including information security.' |
Is the security concept of the device under evaluation appropriate? |
Yes, see:- Risk table- Risk management report- Software development plan |
