← All resources Industry Frameworks
Industry frameworks & playbooks worth knowing
Not government-mandated regulations, not formal published standards — these are voluntary, industry-consensus frameworks from bodies like HSCC and MDIC that shape how manufacturers actually implement security in practice.
| Document | Publisher | Year | Description |
|---|---|---|---|
| Validating Medical Device Cybersecurity Through Penetration Testing | MDIC | Jun 2026 | A five-step framework for scoping, executing, and acting on medical device penetration test results, addressing the industry's lack of a consistent, widely accepted approach. |
| Cybersecurity Risk Analysis for Medical Devices in the Era of Evolving Technologies | MITRE | Apr 2026 | FDA-commissioned discussion paper examining how AI/ML, cloud integration, digital twins, and post-quantum cryptography are reshaping risk analysis methodologies for connected medical devices. |
| Considerations for Managing Challenges in Software Bill of Materials (SBOM) Data Normalization | MITRE | Apr 2026 | Follow-up to MITRE's 2024 SBOM data normalization white paper, continuing to address interoperability and normalization challenges across the medical device SBOM ecosystem. |
| Model Contract-Language for MedTech Cybersecurity v2 (MC2v2) Co-authored by our team | HSCC | Nov 2025 | Template cybersecurity contract language for agreements between device manufacturers and healthcare delivery organizations. |
| 2025 MDIC Cybersecurity Benchmark Report | MDIC | Oct 2025 | Annual industry benchmarking of cybersecurity maturity across the total product lifecycle — organization, risk management, supplier management, design & development, V&V, and maintenance. |
| Data Normalization Challenges and Mitigations in Software Bill of Materials (SBOM) Processing | MITRE | Oct 2024 | White paper for medical device manufacturers on SBOM data normalization — interoperability gaps across SBOM standards, missing or imprecise element definitions, and multi-format ingestion challenges, with recommended mitigations. |
| Medical Device and Health IT Joint Security Plan v2 (JSP2) Co-authored by our team | HSCC | Mar 2024 | FDA-recognized document for implementing a Secure Product Development Framework (SPDF); a total-product-lifecycle reference guide for secure-by-design and secure-by-default medical device and health IT development, and a major refresh of the original 2019 JSP. |
| Playbook for Threat Modeling Medical Devices | MDIC | Feb 2024 | Developed with FDA, MITRE, and Adam Shostack & Associates from 2020-21 threat modeling bootcamps; presents general threat modeling principles and methodologies rather than a single prescriptive approach. |
| Next Steps Toward Managing Legacy Medical Device Cybersecurity Risks | MITRE | Nov 2023 | FDA-commissioned white paper on near-term solutions for managing legacy medical device cybersecurity risk, with specific considerations for less-resourced healthcare delivery organizations such as rural and safety-net hospitals. |
| MedTech Vulnerability Communications Toolkit (MVCT) | HSCC | Oct 2023 | Plain-language templates for communicating device vulnerabilities to clinicians, patients, and other non-security audiences, building on FDA's 2021 best-practices guide. |
| Health Industry Cybersecurity: Managing Legacy Technology Security (HIC-MaLTS) Co-authored by our team | HSCC | Mar 2023 | Modular, actionable guidance for manufacturers and healthcare delivery organizations on managing cybersecurity risk in legacy medical technology as a shared responsibility. |
| Medical Device Cybersecurity Regional Incident Preparedness and Response Playbook | MITRE | Nov 2022 | Framework developed with FDA to help healthcare delivery organizations plan for and respond to medical device cybersecurity incidents, protecting device effectiveness and patient safety. |
| Discussion Paper: Strengthening Cybersecurity Practices Associated with Servicing of Medical Devices | FDA | Jun 2021 | CDRH discussion paper seeking early industry input on shared cybersecurity responsibility across privileged access, vulnerability identification, prevention/mitigation, and product lifecycle challenges in device servicing. |
| Best Practices for Communicating Cybersecurity Vulnerabilities to Patients | FDA | 2021 | FDA guidance on designing clear, timely, patient-centered communications when a device cybersecurity vulnerability needs to be disclosed to patients and caregivers. |
| Rubric for Applying CVSS to Medical Devices | MITRE | Oct 2020 | Developed under FDA contract as an FDA-qualified Medical Device Development Tool (MDDT); extends CVSS scoring with medical-device-specific guidance, including the patient safety dimension CVSS v3.x lacks. |
Not sure which frameworks apply to your program?
We'll help you decide which voluntary frameworks are worth adopting alongside your regulatory obligations.