1-888-310-4540 (main) / 1-888-707-6150 (support) info@spkaa.com
Select Page

What’s in the MITRE/FDA Playbook?

What’s in the MITREFDA Playbook
Published by SPK Blog Post
on December 17, 2018

On October 2018, the MITRE Corporation and the Food and Drug Administration released their joint document, Medical Device Cybersecurity Regional Incident Preparedness and Response Playbook. This is the new Bible for organizations designing and manufacturing connected medical devices.

The document is the product of a four-year partnership between MITRE and the FDA. The document was developed in response to real-world cybersecurity breaches such as WannaCry and Petya/NotPetya. It focuses primarily on these types of potential large-scale threats.

MITRE and the FDA recommend regional collaboration. Individual organizations have necessarily limited resources that might not be up to the task of addressing emergent cybersecurity vulnerabilities. Trusted partnerships, however, established on a regional basis, can pool resources and become greater than the sum of their parts. These pooled resources can assist not only preparedness for existing threats, but fast response to zero day and other emerging threats.

MITRE and the FDA provide a number of concrete suggestions for collaboration in the document including:

  • Joint exercises and simulations
  • Sharing policies, plans and best practices
  • Development of mutual aid response plans
  • Sharing advisories and alerts
  • Ensuring access to shared advisories and alerts
  • Formal and informal methods of real-time information sharing
  • Secondary channels of communication
  • Creation of regional command centers
  • Incident tracking procedures
  • Mutual aid agreements such as diverting patients or sharing devices
  • Mutual technical assistance

Regional groups need not be limited to manufacturers and designers. Stakeholders from the initial design team all the way to patient advocacy groups can and should come together. Cybersecurity for connected medical devices is decidedly an area where there is strength in numbers.

Once regional groups of organizations are established and follow these guidelines, it’s only a logical next step that these regional organizations will begin communicating with one another. This opens the opportunity for unified response across regions as appropriate. Even when cybersecurity breaches occur they can be dealt with swiftly. Contingency plans mean less inconvenience for end users, which in turn provides another layer of safety.

None of this will eliminate cybersecurity threats. What it will do, however, is make organizations more resilient when it comes to vulnerabilities to connected devices. What’s more, the guidelines are very open. This allows organizations and groups of organizations to adapt them in ways that make sense for their specific situation rather than a one-size-fits-all template that might not actually fit all.

Next Steps

Latest White Papers

Atlassian Cloud: Understanding Zero Trust Security

Atlassian Cloud: Understanding Zero Trust Security

Where To Start & Why It Matters What is the Atlassian Cloud Zero Trust Security model? Well, for decades, enterprise security controls were built to protect a large, single perimeter around a corporation. Often described as castle-and-moat security, This approach...

Related Resources

Use Nessus To Harden Your Cybersecurity

Use Nessus To Harden Your Cybersecurity

Cybersecurity should be baked into the onset of IT and product development processes. Additionally, treating cybersecurity as an afterthought opens your organization up to vulnerabilities and risk. Therefore hardening your IT product cybersecurity with a tool like...

How To Complete Computer Systems Validation (FDA)

How To Complete Computer Systems Validation (FDA)

What is Computer Systems Validation (CSV)? Additionally, why does the Food & Drug Administration (FDA) require them for the Medical Device industry? More importantly, how can CSVs be efficiently completed and managed? Let’s explore why you can’t skip that...

Why Process Automation Is Critical For Engineering

Why Process Automation Is Critical For Engineering

Process automation releases your engineers for the work their brains are intended for. That work is creativity and problem-solving.  By implementing process automation, you improve the team’s morale. Firstly, they get more focus time for deep work and designing better...