Webstore

RS ISO/IEEE 11073-40101: 2022
Health informatics — Device interoperability — Part 40101: Foundational — Cybersecurity — Processes for vulnerability assessment

Abstract

Many Personal Health Devices (PHDs) and Point-of-Care Devices (PoCDs) provide vital support for people
living with chronic disease or experiencing a life-threatening medical event. Cybersecurity attacks on
vulnerable devices may lead to the alteration of prescribed therapy (e.g., sleep apnoea breathing therapy,
insulin therapy) or to information disclosure that results in insurance or identity fraud or in direct or indirect
patient harm. Companies subject to a successful cybersecurity attack may suffer financial harm and a negative
reputation.
Manufacturers of regulated PHDs/PoCDs are required to address cybersecurity vulnerabilities through a
detailed risk analysis of use cases specific to the device. Of the various approaches to vulnerability
assessment, some are not repeatable, scalable, systematic, and auditable. Both manufacturers and regulatory
bodies may benefit from a common approach to vulnerability assessment based on threat modeling capable
of analyzing PHDs/PoCDs across domains and described in a trusted open consensus standard. Likewise,
patients, providers, and payers benefit from consistent and sufficient information provided in PHD/PoCD
labeling.
This standard is based on the PHD Cybersecurity Standards Roadmap findings (IEEE white paper [B4]) and
presents a repeatable, scalable, systematic, and auditable approach to vulnerability assessment.2
While a
specific approach is provided, any comparable approach is appropriate and will be compatible with the
mitigations found in IEEE Std 11073-40102™ [B3]. In Figure 1, this standard is depicted by the top row,
and IEEE Std 11073-40102 is depicted by the bottom row.

General Information

Code	Classification	Theme	Pages	Publisher	Availability
RS ISO/IEEE 11073-40101: 2022	ADOPTED ISO STANDARDS	Health care technology	55	First Edition Mar 2024	Available