BS PD IEC TR 80001-2-8-2016 Application of risk management for IT-networks incorporating medical devices Application guidance Guidance on standards for establishing the se.pdf

1、Application of risk management for IT-networks incorporating medical devices Part 2-8: Application guidance Guidance on standards for establishing the security capabilities identified in IEC TR 80001-2-2 PD IEC/TR 80001-2-8:2016 BSI Standards PublicationNational foreword This Published Document is t

2、he UK implementation of IEC/TR 80001-2-8:2016. The UK participation in its preparation was entrusted by Technical Committee CH/62, Electrical Equipment in Medical Practice, to Subcommittee CH/62/1, Common aspects of Electrical Equipment used in Medical Practice. A list of organizations represented o

3、n this committee can be obtained on request to its secretary. This publication does not purport to include all the necessary provisions of a contract. Users are responsible for its correct application. The British Standards Institution 2016. Published by BSI Standards Limited 2016 ISBN 978 0 580 873

4、58 4 ICS 11.040.01 Compliance with a British Standard cannot confer immunity from legal obligations. This Published Document was published under the authority of the Standards Policy and Strategy Committee on 31 May 2016. Amendments/corrigenda issued since publication Date Text affected PUBLISHED DO

5、CUMENT PD IEC/TR 80001-2-8:2016IEC TR 80001-2-8 Edition 1.0 2016-05 TECHNICAL REPORT Application of risk management for IT-networks incorporating medical devices Part 2-8: Application guidance Guidance on standards for establishing the security capabilities identified in IEC TR 80001-2-2 INTERNATION

6、AL ELECTROTECHNICAL COMMISSION ICS 11.040.01 ISBN 978-2-8322-3412-9 Warning! Make sure that you obtained this publication from an authorized distributor. PD IEC/TR 80001-2-8:2016 2 IEC TR 80001-2-8:2016 IEC 2016 CONTENTS FOREWORD . 4 INTRODUCTION . 6 1 Scope 9 2 Normative references. 9 3 Terms and d

7、efinitions 10 4 Guidance for establishing SECURITY CAPABILITIES 13 4.1 General . 13 4.2 Automatic logoff ALOF . 14 4.3 Audit controls AUDT . 15 4.4 Authorization AUTH 17 4.5 Configuration of security features CNFS . 19 4.6 Cyber security product upgrades CSUP 21 4.7 HEALTH DATA de-identification DID

8、T . 24 4.8 Data backup and disaster recovery DTBK . 25 4.9 Emergency access EMRG 27 4.10 HEALTH DATA integrity and authenticity IGAU . 28 4.11 Malware detection/protection MLDP 30 4.12 Node authentication NAUT . 32 4.13 Person authentication PAUT . 35 4.14 Physical locks on device PLOK . 37 4.15 Thi

9、rd-party components in product lifecycle roadmaps RDMP 39 4.16 System and application hardening SAHD 42 4.17 Security guides SGUD 44 4.18 HEALTH DATA storage confidentiality STCF . 47 4.19 Transmission confidentiality TXCF 48 4.20 Transmission integrity TXIG 50 Bibliography . 51 Table 1 ALOF control

10、s . 14 Table 2 AUDT controls . 16 Table 3 AUTH controls . 18 Table 4 CNFS controls . 20 Table 5 CSUP controls . 22 Table 6 DIDT controls 24 Table 7 DTBK controls . 26 Table 8 EMRG controls 28 Table 9 IGAU controls 29 Table 10 MLDP controls . 30 Table 11 NAUT controls . 33 Table 12 PAUT controls . 36

11、 Table 13 PLOK controls . 38 Table 14 RDMP controls 40 Table 15 SAHD controls . 43 PD IEC/TR 80001-2-8:2016IEC TR 80001-2-8:2016 IEC 2016 3 Table 16 SGUD controls. 45 Table 17 STCF controls . 48 Table 18 TXCF controls . 49 Table 19 TXIG controls 50 PD IEC/TR 80001-2-8:2016 4 IEC TR 80001-2-8:2016 IE

12、C 2016 INTERNATIONAL ELECTROTECHNICAL COMMISSION _ APPLICATION OF RISK MANAGEMENT FOR IT-NETWORKS INCORPORATING MEDICAL DEVICES Part 2-8: Application guidance Guidance on standards for establishing the security capabilities identified in IEC TR 80001-2-2 FOREWORD 1) The International Electrotechnica

13、l Commission (IEC) is a worldwide organization for standardization comprising all national electrotechnical committees (IEC National Committees). The object of IEC is to promote international co-operation on all questions concerning standardization in the electrical and electronic fields. To this en

14、d and in addition to other activities, IEC publishes International Standards, Technical Specifications, Technical Reports, Publicly Available Specifications (PAS) and Guides (hereafter referred to as “IEC Publication(s)”). Their preparation is entrusted to technical committees; any IEC National Comm

15、ittee interested in the subject dealt with may participate in this preparatory work. International, governmental and non- governmental organizations liaising with the IEC also participate in this preparation. IEC collaborates closely with the International Organization for Standardization (ISO) in a

16、ccordance with conditions determined by agreement between the two organizations. 2) The formal decisions or agreements of IEC on technical matters express, as nearly as possible, an international consensus of opinion on the relevant subjects since each technical committee has representation from all

17、 interested IEC National Committees. 3) IEC Publications have the form of recommendations for international use and are accepted by IEC National Committees in that sense. While all reasonable efforts are made to ensure that the technical content of IEC Publications is accurate, IEC cannot be held re

18、sponsible for the way in which they are used or for any misinterpretation by any end user. 4) In order to promote international uniformity, IEC National Committees undertake to apply IEC Publications transparently to the maximum extent possible in their national and regional publications. Any diverg

19、ence between any IEC Publication and the corresponding national or regional publication shall be clearly indicated in the latter. 5) IEC itself does not provide any attestation of conformity. Independent certification bodies provide conformity assessment services and, in some areas, access to IEC ma

20、rks of conformity. IEC is not responsible for any services carried out by independent certification bodies. 6) All users should ensure that they have the latest edition of this publication. 7) No liability shall attach to IEC or its directors, employees, servants or agents including individual exper

21、ts and members of its technical committees and IEC National Committees for any personal injury, property damage or other damage of any nature whatsoever, whether direct or indirect, or for costs (including legal fees) and expenses arising out of the publication, use of, or reliance upon, this IEC Pu

22、blication or any other IEC Publications. 8) Attention is drawn to the Normative references cited in this publication. Use of the referenced publications is indispensable for the correct application of this publication. 9) Attention is drawn to the possibility that some of the elements of this IEC Pu

23、blication may be the subject of patent rights. IEC shall not be held responsible for identifying any or all such patent rights. The main task of IEC technical committees is to prepare International Standards. However, a technical committee may propose the publication of a technical report when it ha

24、s collected data of a different kind from that which is normally published as an International Standard, for example “state of the art“. IEC 80001-2-8, which is a technical report, has been prepared by subcommittee 62A: Common aspects of electrical equipment used in medical practice, of IEC technica

25、l committee 62: Electrical equipment in medical practice, and ISO technical committee 215: Health informatics.1)_ 1)This document contains original material that is 2013, Dundalk Institute of Technology, Ireland. Permission is granted to ISO and IEC to reproduce and circulate this material, this bei

26、ng without prejudice to the rights of Dundalk Institute of Technology to exploit the original text elsewhere. PD IEC/TR 80001-2-8:2016IEC TR 80001-2-8:2016 IEC 2016 5 It is published as a double logo technical report. The text of this technical report is based on the following documents of IEC: Enqu

27、iry draft Report on voting 62A/1018/DTR 62A/1043A/RVC Full information on the voting for the approval of this technical report can be found in the report on voting indicated in the above table. In ISO, the standard has been approved by 14 P-members out of 31 having cast a vote. This publication has

28、been drafted in accordance with the ISO IEC Directives, Part 2. Terms used throughout this technical report that have been defined in Clause 3 appear in SMALL CAPITALS. A list of all parts of the IEC 80001 series, published under the general title Application of risk management for it-networks incor

29、porating medical devices, can be found on the IEC website. The committee has decided that the contents of this publication will remain unchanged until the stability date indicated on the IEC website under “http:/webstore.iec.ch“ in the data related to the specific publication. At this date, the publ

30、ication will be reconfirmed, withdrawn, replaced by a revised edition, or amended. A bilingual version of this publication may be issued at a later date. PD IEC/TR 80001-2-8:2016 6 IEC TR 80001-2-8:2016 IEC 2016 INTRODUCTION The IEC 80001-1 standard, the Application of risk management to IT-networks

31、 incorporating medical devices, provides the roles, responsibilities and activities necessary for RISK MANAGEMENT. IEC TR 80001-2-2, the Application of risk management for IT-networks incorporating medical devices Part 2-2: Guidance for the disclosure and communication of medical device security nee

32、ds, risks and controls is a technical report that provides additional guidance in relation to how SECURITY CAPABILITIES might be referenced (disclosed and discussed) in both the RISK MANAGEMENT PROCESS and stakeholder communications and agreements. This technical report provides guidance for the est

33、ablishment of each of the SECURITY CAPABILITIES presented in IEC TR 80001-2-2. IEC TR 80001-2-2 contains an informative set of common, descriptive SECURITY CAPABILITIES intended to be the starting point for a security-centric discussion between the vendor and purchaser or among a larger group of sta

34、keholders involved in a MEDICAL DEVICE IT-NETWORK project. Scalability is possible across a range of different sizes of RESPONSIBLE ORGANIZATIONS (henceforth called healthcare delivery organizations HDOs) as each evaluates RISK using the SECURITY CAPABILITIES and decides what to include or not to in

35、clude according to their RISK tolerance and available resources. This documentation can be used by HDOs as input to their IEC 80001 PROCESS or to form the basis of RESPONSIBILITY AGREEMENTS among stakeholders. Other IEC 80001 technical reports will provide step-by-step guidance in the RISK MANAGEMEN

36、T PROCESS. IEC TR 80001-2-2 SECURITY CAPABILITIES encourage the disclosure of more detailed SECURITY CONTROLS. This technical report identifies SECURITY CONTROLS from key security standards which aim to provide guidance to a RESPONSIBLE ORGANIZATION when adapting the framework outlined in IEC TR 800

37、01-2-2. The framework outlined in IEC TR 80001-2-2 requires shared responsibility between HDOs and MEDICAL DEVICE manufacturers (MDMs). Similarly, this guidance applies to both stakeholders, as a shared responsibility, to ensure safe MEDICAL DEVICE IT networks. In order to build a secure MEDICAL DEV

38、ICE IT network a joint effort from both stakeholders is required. A SECURITY CAPABILITY, as defined in IEC TR 80001-2-2, represents a broad category of technical, administrative and/or organizational SECURITY CONTROLS 2)required to manage RISKS to confidentiality, integrity, availability and account

39、ability of data and systems. This document presents these categories of SECURITY CONTROLS prescribed for a system and the operational environment to establish SECURITY CAPABILITIES to protect the confidentiality, integrity, availability and accountability of data and systems. The SECURITY CONTROLS s

40、upport the maintenance of confidentiality and the protection from malicious intrusion that might lead to compromises in integrity or system/data availability. The SECURITY CONTROLS for each SECURITY CAPABILITY can be added to as the need arises 3) . Controls are intended to protect both data and sys

41、tems but special attention is given to the protection of both PRIVATE DATA and its subset called HEALTH DATA. In addition to providing a basis for discussing RISK and respective roles and responsibilities toward RISK MANAGEMENT, this report is intended to supply: a) Health Delivery Organizations (HD

42、Os) with a catalogue of management, operational and administrative SECURITY CONTROLS to maintain the EFFECTIVENESS of a SECURITY CAPABILITY for a MEDICAL DEVICE on a MEDICAL DEVICE IT-NETWORK; b) MEDICAL DEVICE manufacturers (MDMs) with a catalogue of technical SECURITY CONTROLS for the establishmen

43、t of each of the 19 SECURITY CAPABILITIES. _ 2)For the purpose of consistency throughout this report, the term SECURITY CONTROLS refers to the technical, administrative and organizational controls/safeguards prescribed to establish SECURITY CAPABILITIES. 3)The selection of SECURITY CAPABILITIES and

44、SECURITY CONTROLS will vary due to the diversity of MEDICAL DEVICE products and context in relation to environment and INTENDED USE. Therefore, this technical report is not intended as a “one size fits all” solution. PD IEC/TR 80001-2-8:2016IEC TR 80001-2-8:2016 IEC 2016 7 This report presents the 1

45、9 SECURITY CAPABILITIES, their respective “requirement goal” and “user need” (identical to that in IEC TR 80001-2-2) with a corresponding list of SECURITY CONTROLS from a number of security standards. The security standards used for mapping SECURITY CONTROLS to SECURITY CAPABILITIES include 4) : NIS

46、T SP 800-53, Revision 4, Recommended Security Controls for Federal Information Systems and Organizations NIST Special Publication 800-53 covers the steps in the RISK MANAGEMENT Framework that address SECURITY CONTROL selection for federal information systems in accordance with the security requireme

47、nts in Federal Information Processing Standard (FIPS) 200. This includes selecting an initial set of baseline SECURITY CONTROLS based on a FIPS 199 worst-case impact analysis, tailoring the baseline SECURITY CONTROLS, and supplementing the SECURITY CONTROLS based on an organizational assessment of R

48、ISK. The security rules cover 17 areas including access control, incident response, business continuity, and disaster recoverability. ISO IEC 15408-2:2008, Information technology Security techniques Evaluation criteria for IT security Part 2: Security functional components This standard defines the

49、content and presentation of the security functional requirements to be assessed in a security evaluation using ISO IEC 15408. It contains a comprehensive catalogue of predefined security functional components that will fulfil the most common security needs of the marketplace. These are organized using a hierarchical structure of classes, families and components, and supported by comprehensive user notes. This st