The Key Elements of a Risk-based Product Security Program for Medical Devices: A Scoping Study

One of the main challenges facing medical device manufacturers is to design and develop secure products and services that can successfully withstand evolving cybersecurity threats. Building security and privacy considerations into medical devices and managing privacy and security risks proactively throughout the entire product life cycle requires a structured and systematic approach. The purpose of this paper is to identify in the existing research literature the key elements which are needed to establish a risk-based product security program in order to protect connected medical devices, the healthcare systems, and end users who use them against cybersecurity threats. A scoping study of available IEEE Xplore database literature was used to identify the key elements which are listed in this paper.