Using Card Sorting to Classify Elements of the Security Risk Management Program for Medical Devices

Establishing a security risk management program for medical devices can be challenging. Medical device manufacturers must understand which elements of the program are required, optional, or unnecessary to make effective decisions. By prioritizing the most important elements, manufacturers can establish a robust security risk management program. This paper identifies 40 elements of the security risk management program for medical devices. Using closed card sorting, professionals within the medical device sector classified these elements into predefined categories. The study involved 53 participants who completed two card sorts using an online tool over a period of five weeks.