Medical Device Cybersecurity Checklist (TARA-based)

A step-by-step guide for healthcare IT, clinical engineering, and device manufacturers to secure connected medical systems across the full product lifecycle. Built on PTRG's threat-analysis-and-risk-assessment (TARA) methodology and aligned to FDA Premarket Cybersecurity Guidance, the HIPAA Security Rule, ISO 14971, IEC 62304, and AAMI TIR57.

DNSystems LLC · PTRG · dnsystemsllc.com

1. Scope & Asset Inventory

• List every connected device, model, and firmware/software version in scope.
• Map each device's data flows: on-device, LAN, cloud, mobile app, and update channel.
• Identify the protected health information (PHI) each device stores or transmits.
• Record trust boundaries: who/what talks to the device and over which interface.
• Note remote-access and telemetry paths (vendor support, OTA, cloud dashboards).

2. Threat Identification

• Enumerate threat scenarios against the device, its APIs, cloud, and update mechanism.
• Classify each with STRIDE.
• Include patient-safety threats (incorrect treatment, disabled therapy, false readings).
• Include privacy threats (PHI exposure, unauthorized access, data leakage).
• Include availability threats (device unavailable when clinically needed).

3. Risk Assessment

• Rate feasibility of each threat (attacker access, skill, tooling, known exploits).
• Rate impact across safety, privacy, operational, and financial dimensions.
• Calculate risk = feasibility × impact; prioritize the highest first.
• Cross-reference ISO 14971 harm/risk analysis so cyber risk feeds clinical risk.

4. Controls & Risk Treatment

• Authentication: strong, unique credentials; OAuth 2.0 / token auth on every API.
• Authorization: least-privilege access; no shared or default accounts.
• Transport security: TLS 1.2+ for all device-to-app and device-to-cloud traffic.
• Data-at-rest encryption for PHI on device and in the cloud.
• API hardening: rate limiting, input validation, anomaly alerting, request throttling.
• Secure boot / signed firmware and a verified, authenticated update mechanism.
• Logging, auditing, and monitoring of access and API usage.
• Network segmentation for clinical/OT networks; isolate unmanaged devices.

5. Verification & Evidence

• Penetration test the device, its APIs, cloud, and mobile app — with proof of exploitation.
• Produce a risk register mapping each threat to its control and residual risk.
• Capture documented test results and remediation retest evidence.
• Assemble compliance-ready evidence for FDA submissions and HIPAA audits.

6. Lifecycle & Monitoring

• Re-run the assessment at every software update or major configuration change.
• Maintain a coordinated vulnerability-disclosure / PSIRT process.
• Monitor components against new CVEs (SBOM + VEX) and re-triage exploitability.
• Keep the risk register living — update as threats and the deployment evolve.

Regulatory Alignment

• FDA Premarket Cybersecurity Guidance — design-phase risk management + submission evidence.
• HIPAA Security Rule — safeguarding PHI (administrative, physical, technical controls).
• ISO 14971 — medical device risk management.
• IEC 62304 — medical device software lifecycle processes.
• AAMI TIR57 — medical device cybersecurity risk management principles.