How could a product security classification scheme for a medical device manufacturer look, and what drives each scale?
Rate confidentiality, integrity, availability and business impact from Low to High, and anchor every level in a concrete consequence: patient safety, delayed treatment, inconvenience, or revenue.
| Confidentiality | Integrity | Availability | Business impact | |
|---|---|---|---|---|
| High | Stores personal medical data | Manipulated data causes a safety impact | Breakdown causes a safety impact | Strategic product, revenue > 500m |
| Medium | Holds confidential data such as credentials | Manipulated data causes treatment issues | Breakdown delays treatment | Profitable product, revenue > 100m |
| Low | Public data only | Minor inconvenience | Minor inconvenience | Supporting product, revenue < 100m |
The factors behind the scales are what the market and the regulator care about. For medical devices that is patient safety first, then health data (special-category personal data under data protection law), then continuity of treatment and the product's commercial weight. Each level names an observable consequence, not an adjective, so two people classifying the same product reach the same answer. The highest rating in any column usually sets the product's overall class.
Go deeper:
MDCG 2019-16 — Guidance on cybersecurity for medical devices (EU) — how EU regulators link security to patient safety- FDA — Cybersecurity in medical devices (premarket guidance) — the US counterpart