A cybersecurity risk analysis methodology for medical devices

The U.S. Food and Drug Administration (FDA) has expressed an ongoing emphasis on cybersecurity considerations for medical devices. The FDA recently issued guidelines regarding cybersecurity management in premarket submissions. In this paper we present a brief overview of security frameworks, and develop a cybersecurity risk assessment methodology for medical devices. Our approach is essentially the application of a Preliminary Hazards Analysis study, customized to cybersecurity considerations. We illustrate this methodology using a typical, but hypothetical, medical device.