6.2. Risk Management Steps
6.2 Risk Management Steps Risks can occur at any stage in a medical device’s TPLC. These stages typically include concept and design, manufacturing and supply chain, distribution and installation, clinical use and operation, maintenance and servicing, post-market surveillance, and end-of-life decommissioning or disposal. Sometimes, a risk identified at one stage can be addressed by actions taken at a completely different stage. For example, a software vulnerability discovered during clinical use (post-market) may be mitigated by implementing stronger secure-by-design controls in the next product iteration or by releasing a security patch to existing devices. Because of this interconnected nature, the risk management steps should cover the entire life cycle. In practice, this means the systematic application of risk management principles from the device’s initial concept and design all the way through to its End of Life (EOL). Risk Management Planning The process begins with the establishment of Risk Management Plan, which formally declares that cybersecurity is within the scope of risk management activities. This plan should define specific criteria for determining the acceptability of risks arising from security threats. Furthermore, it is essential that the team responsible for risk management includes individuals with dedicated cybersecurity expertise, who can properly identify and assess threats that are unique to the digital and networked nature of modern medical devices. Risk Analysis During the Risk Analysis phase, the team should identify potential hazards and the foreseeable sequences of events that could lead to harm. In the cybersecurity context, a hazard often stems from compromises to the confidentiality, integrity, or availability of the device, its data, software and functions. These compromises via threats such as malware, unauthorised access, or denial-of-service attacks can create hazardous situations that lead to harm (e.g., patient injury from altered device function, delayed treatment, or incorrect clinical decisions). The risk analysis involves documenting the device's security characteristics, such as its network connectivity, the data it handles BEST PRACTICES GUIDE FOR MEDICAL DEVICE CYBERSECURITY AUGUST 2026 GL-10 R1 Page 17 of 38 and its software components, to understand its attack surface and potential vulnerabilities. Following identification, the risk associated with each hazardous situation is to be estimated. This involves determining the potential severity of harm and the probability (or likelihood) of that harm occurring. For example, a ransomware attack that renders a medical device inoperable could lead to a catastrophic outcome for a patient dependent on it. Estimating the probability of a cyberattack could be difficult due to the intentional nature of threats. In such cases, it is recommended to assess exploitability (e.g. Common Vulnerability Scoring System approaches) of known vulnerabilities. If vulnerability is known and exploitable, one should assume it could be targeted and focus the analysis on the severity of the resulting harm. Risk Evaluation The Risk Evaluation phase is where formal judgment is made. Each estimated risk is compared against the acceptability criteria established in the risk management plan, often visualised using a risk matrix. This matrix plots severity against probability, with predefined regions for acceptable and unacceptable risks based on the criteria established in the risk management plan. If a risk, such as the remote alteration of an infusion pump's dosage, falls into the unacceptable region, it is evaluated as unacceptable and documented as requiring mitigation. Risks should be reduced as far as possible using the hierarchy of risk controls (see Risk Control below). Risk Control When a risk is evaluated as unacceptable, the Risk Control phase is initiated. Risk control measures should be selected and implemented according to the following hierarchy of preference (per ISO 14971): • Inherent safety by design (e.g., secure boot, code signing, hardened OS); • Protective measures (e.g., encryption, network segmentation); • Information for safety (e.g., clear instructions on patch management or limitations). Examples of effective security controls include the following: BEST PRACTICES GUIDE FOR MEDICAL DEVICE CYBERSECURITY AUGUST 2026 GL-10 R1 Page 18 of 38 • Authentication & Authorisation: Passwords, role-based access control • Encryption: Protecting data at rest and in transfer • Secure Design: Hardening the operating system, code signing, secure boot • Network Segmentation: Isolating the medical device from non-critical networks • Patch Management: Having a process to update software to fix vulnerabilities The goal of each control is to either reduce the likelihood of a successful attack or limit the severity of the harm if an attack occurs. Evaluation of Residual Risk After implementing controls, the remaining risk, known as residual risk, should be evaluated to determine whether the security measures have reduced the risk to the predefined acceptable level. As no control is perfect, some residual risk will remain. The team should analyse this remaining risk to confirm that it meets the acceptability criteria and does not introduce new hazards. If a residual risk is still considered unacceptable after all practicable controls have been applied, a Benefit-Risk Analysis should be performed. The manufacturer should provide a documented justification that the medical benefits of using the medical device for the patient and user outweigh the remaining residual risks. Continuous Monitoring and Improvement Cybersecurity risk management is not a one-time effort. It is a continuous process that extends throughout the device's entire life cycle through production and post- production activities. This includes actively monitoring threat intelligence sources for new vulnerabilities, maintaining an incident response plan, and providing security patches to customers. New information gathered from the field should be fed back into the risk management file and may initiate a new cycle of risk analysis and evaluation to help ensure that the device remains safe and secure over time. BEST PRACTICES GUIDE FOR MEDICAL DEVICE CYBERSECURITY AUGUST 2026 GL-10 R1 Page 19 of 38