Playbook for Threat Modeling Medical Devices

November 2021
Topics: Medical Devices, Cybersecurity, Health, Information Security, Information Security Risk Management, Medicine
Elaine Bochniewicz, The MITRE Corporation
Melissa P. Chase, The MITRE Corporation
Steven M. Christey Coley, The MITRE Corporation
Kyle Wallace, The MITRE Corporation
Matt Weir, The MITRE Corporation
Margie Zuk, The MITRE Corporation
Download PDF (3.19 MB)

The “Playbook for Threat Modeling Medical Devices” was developed to increase knowledge of threat modeling throughout the medical device ecosystem in order to further strengthen the cybersecurity and safety of medical devices.

Medical devices are increasingly complex and connected systems existing in complex connected ecosystems of healthcare delivery. Standard security controls can ensure some baseline security capabilities, but they fail to address the myriad of ways that medical devices are used, interface with the healthcare ecosystem, and most important, how security risks could result in unacceptable safety issues. Instead, for several years, the Food and Drug Administration (FDA) has recognized the value of threat modeling as an approach to strengthen the cybersecurity and safety of medical devices. To increase knowledge and understanding of threat modeling throughout the medical device ecosystem, FDA engaged with MITRE, the Medical Device Innovation Consortium (MDIC), and Adam Shostack to conduct a series of threat modeling bootcamps and develop a playbook based on the learnings from those bootcamps.
The “Playbook for Threat Modeling Medical Devices” provides a foundation that can inform an organization’s threat modeling practices. It is intended to serve as a resource for developing or evolving a threat modeling practice. The playbook is not prescriptive in that it does not describe one approach to be used when threat modeling medical devices but focuses on general threat modeling principles. In addition, the playbook provides insights on how an organization can develop or evolve an approach to creating threat models in a systematic and consistent way to achieve those objectives.

Please send comments or suggestions about the playbook to



Publication Search