Healthcare Safety Consortium Extends ISA Cybersecurity Standards to Connected Medical Devices

The Medical Device Innovation, Safety, and Security Consortium (MDISS), a major nonprofit public health and patient safety organization, has announced it is developing a set of recommended practices and profiles for securing medical systems based on the normative requirements in the widely used ISA/IEC 62443 series of standards for industrial automation and control systems cybersecurity. 
 
The intent is to share the information across the network of MDISS member organizations, which includes medical device manufacturers, healthcare software companies, hospital networks, and insurance companies. “MDISS is committed to improving the state of cybersecurity in medical devices and systems to reduce risks to patients. We view the ISA/IEC 62443 standards as providing a solid basis for the development of comprehensive profiles and recommended practices in this area,” stated Dr. Dale Nordenberg, MDISS executive director.
 
The ISA/IEC 62443 standards are developed primarily by the ISA99 committee of the International Society of Automation, with simultaneous review and adoption by the Geneva-based International Electrotechnical Commission.ISA99 draws on the input of cybersecurity experts from across the globe in developing standards in a balanced, consensus process that is accredited by the American National Standards Institute. The standards are applicable to all industry sectors and critical infrastructure, providing a flexible and comprehensive framework to address and mitigate current and future security vulnerabilities in industrial automation and control systems.
 
Application to connected medical devices reflects the growing use of the standards across multiple sectors worldwide, pointed out long-time ISA99 co-chair Eric Cosman. “When we first formed the ISA99 committee, we deliberately stated our scope in terms of potential consequences rather than limiting ourselves to specific industries. This decision has served us well as the ISA/IEC 62443 standards not only have been applied across traditional manufacturing and industrial processing sectors, but also extended to rail transportation, building automation, and now medical systems.”
 
The MDISS announcement follows another recent indication of the widespread adoption of the ISA/IEC 62443 standards in which the United Nations Economic Commission for Europe confirmed it will integrate the standards into its forthcoming Common Regulatory Framework on Cybersecurity (CRF). The CRF will serve as an official UN policy position statement for the massive EU trade markets.
 
The International Society of Automation is a nonprofit professional association that sets the standard for those who apply engineering and technology to improve the management, safety, and cybersecurity of modern automation and control systems used across industry and critical infrastructure. Founded in 1945, ISA develops widely used global standards; certifies industry professionals; provides education and training; publishes books and technical articles; hosts conferences and exhibits; and provides networking and career development programs for its 40,000 members and 400,000 customers around the world.
 
ISA owns Automation.com, an online publisher of automation-related content, and is the founding sponsor of The Automation Federation, an association of non-profit organizations serving as “The Voice of Automation.” Through a wholly owned subsidiary, ISA bridges the gap between standards and their implementation with the ISA Security Compliance Institute and the ISA Wireless Compliance Institute.