legacy-medical-device-security-frameworks

MDRS Methodology

This document expands on paper Section 5 with implementation-level detail relevant to the reference calculator. It is intended for practitioners adapting the calculator to their environment, and for researchers conducting sensitivity analysis or empirical re-calibration.

Why a device-level score?

Existing scoring approaches address adjacent but different needs:

MDRS is a device-level, transparent, reproducible composite designed for triage of legacy devices in clinical environments. Its claim to novelty rests on two specific contributions: the irreversibility-driven tier floor and the CCD-driven tier promoter.

The two stages

Stage 1: Weighted composite

MDRS_comp = (CIS × w_CIS) + (ES × w_ES) + (DCI × w_DCI) + (NEF × w_NEF) + (CCD × w_CCD)

with default weights (0.35, 0.25, 0.20, 0.15, 0.05) summing to 1.0. Each dimension is scored on a 1–10 scale per paper Table 5.

Stage 2: Floor and promoter

After computing the composite and mapping to a base tier, two adjustments are applied in order:

  1. Irreversibility-driven tier floor. A device with high clinical impact cannot be triaged below a defined floor regardless of its exploitability profile. Specifically:
    • If CIS ≥ 9 and base tier is below HIGH → tier is set to HIGH.
    • If 7 ≤ CIS < 9 and base tier is below MEDIUM → tier is set to MEDIUM.
    • Otherwise: no change.
  2. CCD-driven tier promoter. If CCD ≥ 8 (no or minimal compensating controls), the tier is promoted by one level relative to the post-floor tier, capped at CRITICAL.

Both adjustments may activate. The most extreme combined effect is a device with CIS ≥ 9 and CCD ≥ 8: the floor lifts to HIGH and the promoter lifts to CRITICAL, regardless of any other dimension. This is by design — a life-sustaining device with no compensating controls is the worst-case operational profile.

Tier mapping

Tier Composite range Action timeline
CRITICAL ≥ 8.0 (or promoted from HIGH) Immediate / 24 hours
HIGH 6.0 ≤ score < 8.0 (or floored from CIS ≥ 9) 30 days
MEDIUM 3.5 ≤ score < 6.0 (or floored from CIS = 7–8) 90 days
LOW < 3.5 12 months

Boundaries are defined inclusively at the upper end and exclusively at the lower end, eliminating gaps between adjacent tiers.

Why these weights?

The weights reflect clinical prioritisation:

The weights are expert judgement informed by the literature and regulatory guidance, not empirically derived through structured elicitation. The calculator implements weights as configuration parameters precisely so that organisations and researchers can perform sensitivity analysis and re-calibration.

Why the floor?

Conventional risk scoring multiplies probability by impact. For a life-sustaining device in active therapy, the harm is irreversible by the time it is detected. Probability-weighted scoring, in this regime, fails to differentiate “low probability of irreversible harm” from “low probability of recoverable harm” — but the operational treatment must differ. The floor is the simplest explicit mechanism to encode this.

The floor is not a substitute for the composite. It is a minimum below which a device with high clinical impact cannot be triaged regardless of other factors. Devices may legitimately score above the floor on the basis of the composite alone; the floor only changes outcomes when the composite would have produced an outcome below it.

Why the promoter?

The CCD score is the most directly practitioner-actionable dimension: improving compensating controls is something a security programme can do. With a 5% composite weight, however, a one-point CCD reduction changes the composite by only 0.05 — typically not enough to change tiers. Without the promoter, a device with no compensating controls and moderate other dimensions could remain in MEDIUM and never escalate to leadership attention.

The promoter inverts the asymmetry. If CCD ≥ 8, the tier is escalated by one level. This causes practitioner attention to track the most-tractable risk factor without distorting the composite for devices with effective controls.

Edge cases

Sensitivity analysis recipes

Practitioners considering re-calibration should consider these analyses:

  1. CIS-weight sensitivity. Vary w_CIS from 0.20 to 0.50 in steps of 0.05; observe how many devices in the inventory cross tier boundaries. If the inventory is well calibrated, most devices should remain in the same tier across this range.
  2. CCD-weight sensitivity. Vary w_CCD from 0.05 to 0.15. The promoter mechanism makes most devices insensitive to this parameter; if many devices change tiers, the inventory may have an unusual distribution worth investigating.
  3. Floor-strictness analysis. With the floor disabled, how many devices currently scored at or above HIGH would drop below? This quantifies the effect of the irreversibility adjustment for the specific inventory.
  4. Promoter-strictness analysis. Same analysis for the promoter.

The calculator’s JSON export captures all input values and derived results, suitable as input to a sensitivity-analysis script.

References

See the companion paper for the full reference list. Standards directly relevant to MDRS are: