{"id":435962,"date":"2024-10-20T07:52:16","date_gmt":"2024-10-20T07:52:16","guid":{"rendered":"https:\/\/pdfstandards.shop\/product\/uncategorized\/aami-tir5-2016-r2023\/"},"modified":"2024-10-26T14:53:44","modified_gmt":"2024-10-26T14:53:44","slug":"aami-tir5-2016-r2023","status":"publish","type":"product","link":"https:\/\/pdfstandards.shop\/product\/publishers\/aami\/aami-tir5-2016-r2023\/","title":{"rendered":"AAMI TIR5 2016 R2023"},"content":{"rendered":"

This technical Information Report (TIR) provides guidance on methods to perform information security risk management for a medical device in the context of the Safety Risk Management process required by ISO 14971. The TIR incorporates the expanded view of risk management from IEC 80001-1 by incorporating the same key properties of Safety, Effectiveness and Data & Systems Security with Annexes that provide process details and illustrative examples.<\/p>\n

PDF Catalog<\/h4>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
PDF Pages<\/th>\nPDF Title<\/th>\n<\/tr>\n
1<\/td>\nAAMI TIR57:2016\/(R)2023; Principles for medical device security\u2014Risk management <\/td>\n<\/tr>\n
3<\/td>\nTitle page <\/td>\n<\/tr>\n
4<\/td>\nAAMI Technical Information Report
Copyright information <\/td>\n<\/tr>\n
5<\/td>\nContents <\/td>\n<\/tr>\n
6<\/td>\nGlossary of equivalent standards <\/td>\n<\/tr>\n
7<\/td>\nCommittee representation <\/td>\n<\/tr>\n
9<\/td>\nForeword <\/td>\n<\/tr>\n
10<\/td>\nIntroduction <\/td>\n<\/tr>\n
11<\/td>\nFigure 1 – Schematic representation of the risk management process (ANSI\/AAMI\/ISO 14971:2007) <\/td>\n<\/tr>\n
12<\/td>\nFigure 2 \u2013 A Venn diagram showing the relationship between security and safety risks <\/td>\n<\/tr>\n
15<\/td>\n1 Scope
2 Terms and definitions <\/td>\n<\/tr>\n
19<\/td>\n3 General guidance for performing security risk management
3.1 Security risk management process <\/td>\n<\/tr>\n
20<\/td>\nFigure 3 – Schematic representation of the security risk management process
3.1.1 Relationship between security and safety risk management <\/td>\n<\/tr>\n
21<\/td>\nFigure 4 \u2013 Relationships between the security risk and safety risk management processes
3.2 Management responsibilities <\/td>\n<\/tr>\n
22<\/td>\n3.3 Qualification of personnel
3.4 Security risk management plan <\/td>\n<\/tr>\n
23<\/td>\n3.5 Security risk management file
4 Security risk analysis
4.1 Security risk analysis process
4.2 Intended use and identification of characteristics related to the security of the medical device <\/td>\n<\/tr>\n
24<\/td>\n4.3 Identification of threats, vulnerabilities, assets, and adverse impacts
4.3.1 Identification of threats
4.3.2 Identification of vulnerabilities <\/td>\n<\/tr>\n
25<\/td>\n4.3.3 Identification of assets
4.3.4 Identification of adverse impacts
4.4 Estimation of the risk(s) for each applicable threat and vulnerability combination <\/td>\n<\/tr>\n
26<\/td>\n5 Security risk evaluation
6 Risk control
6.1 Security risk reduction
6.2 Security risk control option analysis
6.3 Implementation of risk control measure(s)
6.4 Residual risk evaluation <\/td>\n<\/tr>\n
27<\/td>\n6.5 Risk\/benefit analysis
6.6 Risks arising from risk control measures
6.7 Completeness of risk control
7 Evaluation of overall residual security risk acceptability <\/td>\n<\/tr>\n
28<\/td>\n8 Security risk management report
9 Production and post-production information <\/td>\n<\/tr>\n
30<\/td>\nAnnex A, Security engineering principles and nomenclature
A.1 Overview <\/td>\n<\/tr>\n
31<\/td>\nA.2 Uniqueness of embedded medical systems <\/td>\n<\/tr>\n
32<\/td>\nA.3 Stakeholders
A.3.1 Patients, family, friends, and caregivers
A.3.2 Regulators
A.3.3 Health Delivery Organizations (HDOs)
A.3.4 Manufacturers
A.3.5 Academics
A.3.6 Cyber Liability Insurers
A.4 Security objectives and goals <\/td>\n<\/tr>\n
33<\/td>\nA.5 Considerations for emergency access
A.6 Medical device security architecture considerations <\/td>\n<\/tr>\n
35<\/td>\nAnnex B, Security risk assessment
B.1 Risk assessment process <\/td>\n<\/tr>\n
36<\/td>\nFigure B.1 – A basic high-level risk assessment process
B.1.1 Prepare for assessment <\/td>\n<\/tr>\n
37<\/td>\nB.1.2 Conduct assessment
B.1.3 Communicate results
B.1.4 Maintain assessment
B.1.5 Other security risk assessment processes
B.1.5.1 Common vulnerability scoring system (CVSS)
B.1.5.2 Open web application security project (OWASP)
B.1.5.3 Attack trees <\/td>\n<\/tr>\n
38<\/td>\nB.2 Risk model <\/td>\n<\/tr>\n
40<\/td>\nB.2.1 Threat assessment
B.2.1.1 Characteristics of adversarial threats <\/td>\n<\/tr>\n
42<\/td>\nB.2.1.2 Threat events <\/td>\n<\/tr>\n
43<\/td>\nB.2.1.3 Example threats
B.2.2 Vulnerability assessment <\/td>\n<\/tr>\n
44<\/td>\nB.2.2.1 Example vulnerability classes <\/td>\n<\/tr>\n
45<\/td>\nB.2.3 Impact assessment
B.2.3.1 Asset inventory <\/td>\n<\/tr>\n
46<\/td>\nB.2.3.2 Asset identification <\/td>\n<\/tr>\n
47<\/td>\nB.3 Assessment approaches
B.4 Security analysis approaches <\/td>\n<\/tr>\n
49<\/td>\nB.5 Assessing security risk <\/td>\n<\/tr>\n
51<\/td>\nAnnex C, Generating cybersecurity requirements <\/td>\n<\/tr>\n
53<\/td>\nAnnex D, Questions that can be used to identify medical device security characteristics
D.1 Essential performance <\/td>\n<\/tr>\n
54<\/td>\nD.2 Data storage
D.2.1 PII\/Private data assets <\/td>\n<\/tr>\n
55<\/td>\nD.2.2 Non-PII data assets
D.3 Data transfer <\/td>\n<\/tr>\n
56<\/td>\nD.4 Authentication & authorization <\/td>\n<\/tr>\n
57<\/td>\nD.5 Auditing <\/td>\n<\/tr>\n
58<\/td>\nD.6 Physical security <\/td>\n<\/tr>\n
59<\/td>\nD.7 Device\/system updates <\/td>\n<\/tr>\n
60<\/td>\nD.8 Hardening <\/td>\n<\/tr>\n
61<\/td>\nD.9 Emergency access
D.10 Malware\/virus protection <\/td>\n<\/tr>\n
62<\/td>\nD.11 Backup\/disaster recovery
D.12 Labeling <\/td>\n<\/tr>\n
63<\/td>\nAnnex E, Security risk examples applied to a medical device
E.1 The Kidneato System <\/td>\n<\/tr>\n
64<\/td>\nFigure E.1- Block diagram of the Kidneato system, managed environment <\/td>\n<\/tr>\n
65<\/td>\nFigure E.2 \u2013 Block diagram of the Kidneato system, patient environment <\/td>\n<\/tr>\n
66<\/td>\nE.2 Kidneato programmer <\/td>\n<\/tr>\n
67<\/td>\nE.3 In-home monitor (IHM)
E.4 Web services <\/td>\n<\/tr>\n
68<\/td>\nE.5 Web services – Direct access <\/td>\n<\/tr>\n
69<\/td>\nE.6 Web services – Instrument access
E.7 Example implementations
E.7.1 Example #1 Basic Cyber Hygiene <\/td>\n<\/tr>\n
70<\/td>\nE.7.1.1 Security analysis
E.7.1.2 Security risk evaluation
Table E.1 – Security risk evaluation table <\/td>\n<\/tr>\n
73<\/td>\nE.7.2 Example #2 Implant Communications
E.7.2.1 Security analysis
E.7.2.2 Security risk
E.7.2.3 Likelihood
E.7.2.4 Impact
E.7.2.5 Risk estimation <\/td>\n<\/tr>\n
74<\/td>\nTable E.2 – Risk estimation analysis example
E.7.2.6 Implemented control
E.7.2.7 Residual risk estimation
Table E.3 – Residual risk estimation analysis example
E.7.2.8 New risk identification <\/td>\n<\/tr>\n
75<\/td>\nE.7.3 Example #3 WCA Firmware Update
E.7.3.1 Initial Design
E.7.3.2 Attack of the Design <\/td>\n<\/tr>\n
76<\/td>\nE.7.3.3 Results from the Attack
E.7.3.4 Analysis <\/td>\n<\/tr>\n
78<\/td>\nE.7.3.5 Security Risk Controls <\/td>\n<\/tr>\n
79<\/td>\nAnnex F, A comparison of terminology between key referenced standards
Table F.1 – Related terms in security standards\/technical reports <\/td>\n<\/tr>\n
82<\/td>\nBibliography <\/td>\n<\/tr>\n<\/table>\n","protected":false},"excerpt":{"rendered":"

AAMI TIR57:2016 (R2023) Principles For Medical Device Security – Risk Management<\/b><\/p>\n\n\n\n\n
Published By<\/td>\nPublication Date<\/td>\nNumber of Pages<\/td>\n<\/tr>\n
AAMI<\/b><\/a><\/td>\n2016<\/td>\n84<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n","protected":false},"featured_media":435971,"template":"","meta":{"rank_math_lock_modified_date":false,"ep_exclude_from_search":false},"product_cat":[2654],"product_tag":[],"class_list":{"0":"post-435962","1":"product","2":"type-product","3":"status-publish","4":"has-post-thumbnail","6":"product_cat-aami","8":"first","9":"instock","10":"sold-individually","11":"shipping-taxable","12":"purchasable","13":"product-type-simple"},"_links":{"self":[{"href":"https:\/\/pdfstandards.shop\/wp-json\/wp\/v2\/product\/435962","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pdfstandards.shop\/wp-json\/wp\/v2\/product"}],"about":[{"href":"https:\/\/pdfstandards.shop\/wp-json\/wp\/v2\/types\/product"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/pdfstandards.shop\/wp-json\/wp\/v2\/media\/435971"}],"wp:attachment":[{"href":"https:\/\/pdfstandards.shop\/wp-json\/wp\/v2\/media?parent=435962"}],"wp:term":[{"taxonomy":"product_cat","embeddable":true,"href":"https:\/\/pdfstandards.shop\/wp-json\/wp\/v2\/product_cat?post=435962"},{"taxonomy":"product_tag","embeddable":true,"href":"https:\/\/pdfstandards.shop\/wp-json\/wp\/v2\/product_tag?post=435962"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}