This document expands on paper Section 5 with implementation-level detail relevant to the reference calculator. It is intended for practitioners adapting the calculator to their environment, and for researchers conducting sensitivity analysis or empirical re-calibration.
Existing scoring approaches address adjacent but different needs:
MDRS is a device-level, transparent, reproducible composite designed for triage of legacy devices in clinical environments. Its claim to novelty rests on two specific contributions: the irreversibility-driven tier floor and the CCD-driven tier promoter.
MDRS_comp = (CIS × w_CIS) + (ES × w_ES) + (DCI × w_DCI) + (NEF × w_NEF) + (CCD × w_CCD)
with default weights (0.35, 0.25, 0.20, 0.15, 0.05) summing to 1.0. Each dimension is scored on a 1–10 scale per paper Table 5.
After computing the composite and mapping to a base tier, two adjustments are applied in order:
CIS ≥ 9 and base tier is below HIGH → tier is set to HIGH.7 ≤ CIS < 9 and base tier is below MEDIUM → tier is set to MEDIUM.CCD ≥ 8 (no or minimal compensating controls), the tier is promoted by one level relative to the post-floor tier, capped at CRITICAL.Both adjustments may activate. The most extreme combined effect is a device with CIS ≥ 9 and CCD ≥ 8: the floor lifts to HIGH and the promoter lifts to CRITICAL, regardless of any other dimension. This is by design — a life-sustaining device with no compensating controls is the worst-case operational profile.
| Tier | Composite range | Action timeline |
|---|---|---|
| CRITICAL | ≥ 8.0 (or promoted from HIGH) | Immediate / 24 hours |
| HIGH | 6.0 ≤ score < 8.0 (or floored from CIS ≥ 9) | 30 days |
| MEDIUM | 3.5 ≤ score < 6.0 (or floored from CIS = 7–8) | 90 days |
| LOW | < 3.5 | 12 months |
Boundaries are defined inclusively at the upper end and exclusively at the lower end, eliminating gaps between adjacent tiers.
The weights reflect clinical prioritisation:
The weights are expert judgement informed by the literature and regulatory guidance, not empirically derived through structured elicitation. The calculator implements weights as configuration parameters precisely so that organisations and researchers can perform sensitivity analysis and re-calibration.
Conventional risk scoring multiplies probability by impact. For a life-sustaining device in active therapy, the harm is irreversible by the time it is detected. Probability-weighted scoring, in this regime, fails to differentiate “low probability of irreversible harm” from “low probability of recoverable harm” — but the operational treatment must differ. The floor is the simplest explicit mechanism to encode this.
The floor is not a substitute for the composite. It is a minimum below which a device with high clinical impact cannot be triaged regardless of other factors. Devices may legitimately score above the floor on the basis of the composite alone; the floor only changes outcomes when the composite would have produced an outcome below it.
The CCD score is the most directly practitioner-actionable dimension: improving compensating controls is something a security programme can do. With a 5% composite weight, however, a one-point CCD reduction changes the composite by only 0.05 — typically not enough to change tiers. Without the promoter, a device with no compensating controls and moderate other dimensions could remain in MEDIUM and never escalate to leadership attention.
The promoter inverts the asymmetry. If CCD ≥ 8, the tier is escalated by one level. This causes practitioner attention to track the most-tractable risk factor without distorting the composite for devices with effective controls.
CIS = 9, ES = 7, DCI = 7, NEF = 7, CCD = 1 produces composite 7.05 → HIGH. The floor is HIGH; floor is satisfied without modification. The floor does not reduce a higher tier to its floor; it raises a lower tier to its floor.6.0 × 5 weights evaluates as 5.999... and incorrectly maps to MEDIUM.Practitioners considering re-calibration should consider these analyses:
w_CIS from 0.20 to 0.50 in steps of 0.05; observe how many devices in the inventory cross tier boundaries. If the inventory is well calibrated, most devices should remain in the same tier across this range.w_CCD from 0.05 to 0.15. The promoter mechanism makes most devices insensitive to this parameter; if many devices change tiers, the inventory may have an unusual distribution worth investigating.The calculator’s JSON export captures all input values and derived results, suitable as input to a sensitivity-analysis script.
See the companion paper for the full reference list. Standards directly relevant to MDRS are: