MEM Cybersecurity Working Group Update to PCD Technical Committee Sept. 14, 2016

IHE PCD MEM Cybersecurity Working Group - Mission: Develop and provide cybersecurity guidance to the larger patient care and medical device industries: technology best practices, recommended policies & procedures, regulatory compliance, education and enablement, and sharing across stakeholders. This will build on and use existing healthcare and non-healthcare security frameworks and standards (e.g. IHE ITI but also non-IHE) and will consolidate and apply them to the unique medical device use cases. Current Cybersecurity Working Group Members: Philips, Draeger, Smiths Medical, Symantec, BBraun, individual members Existing Relationships: IHE ITI, IHE PCD MEM DMC/LS Group MDISS (MOU in place) Shared members: AAMI Device Security WG (TIR 57), Advamed, NH-ISAC, ISO TC215 JWG 7 Working relationships: FDA, US-CERT, DHS, ECRI Past Projects (completed): Cybersecurity Awareness WP (2011) Cybersecurity Best Practices WP (2015) ** Medical Device Patching WP (2015, in cooperation with MDISS) ** ** should be updated to reflect recent FDA Cybersecurity Guidance

Medical Device Cybersecurity Ecosystem Map – DRAFT (2016 08 22) Security Community Threat, Incident, & Vulnerability Intelligence Security Research Security Frameworks & Best Practices Regulations, Standards, Frameworks Government & Local Requirements Compliance Security Privacy Information Systems Security Risk Analysis & Management Security Defense & Incident Response Auditing & Reporting Medical Device Market Approval Manufacturing Quality Systems (GMP) Hazard Analysis Certification & Assurance Security Baseline Certification Standards Testing & Certification Auditing & Reporting Integration & Maintenance Vulnerability Sharing & Mgmt. Incident Reporting Life Cycle Maintenance (patching, etc.) Integration Architecture Manufacturer HDO Objective: Safety, Operational reliability, protect IP Policies & Procedures, incl. Quality System Contract Mgmt / Agreements / Supply Chain Software & Security Design Best Practices Asset Mgmt. Risk Mgmt. (Hazard Analysis, etc.) Risk Mitigation Threat & Vulnerability Sharing Incident Response & Reporting Documentation Secure Remote Access Objective: Minimize C-I-A Risk to Safety, Security, Privacy Policies & Procedures Contract Mgmt / Agreements / Procurement Asset, Configuration & Lifecycle (Change) Mgmt. Risk Mgmt. (HDO level) Risk Mitigation Incident Response & Reporting Device EOL Training & Education

IHE PCD MEM Cybersec WG - Proposal Update 2015 WPs to reflect FDA Postmarket Security Guidance (upon final release) Complete Ecosystem map: Review internally (IHE) and externally (public review) Produce & publish final Identify already active stakeholders or existing standards/ frameworks for each topic areas Identify gaps Propose how to address gaps Approach (whitepaper, specifications, standards, etc.) Suggested owner (IHE or outside) This approach is in line with IHE’s mission to provide guidance to the industry on complex and multi-stakeholder problems.

Obstacles: Bench strength – small group. Manufacturers only – how can we get better contribution from (and attract) HDO’s? US-focus – lack of international exposure and visibility. Official Mission and Tasks – how to proceed? This proposal for review and approval / turn proposal into a official project?