Cyber Templates

Cyber templates for cyber risk assessment of vulnerabilities

Cyber Incident Response Exercise

---

📜 Worksheet A: Cyber Risk Assessment of Medical Device Vulnerabilities

Participant Name: ____________________
Date: ______________
Device Name & Model: ______________
System Version: ______________

1️⃣ Asset Identification & Classification

• Device Type: ____________________
• Critical Functionality: ____________________
• Impact Level (🔴 High / 🟡 Medium / 🟢 Low): ____________________

2️⃣ Threat & Vulnerability Identification

✅ Source of Vulnerabilities (CVE, CISA, threat intel, static/dynamic scanner, SBOM): ____________________
✅ Software Components at Risk: ____________________
✅ Supply Chain Risks: ____________________
✅ Safety Risks (Patient Harm Potential): ____________________

Processes Impacted by Vulnerabilities

✅ Threat Intelligence Feed Alerts (CISA, MITRE, ISAO, FDA Notifications): ____________________
✅ Vulnerability Disclosure & Reporting Mechanisms: ____________________
✅ Safety / Clinical Risk Assessment Impact: ____________________
✅ Sources of Vulnerabilities (Firmware, Open-Source Dependencies, Third-Party Components): ____________________

3️⃣ Risk Evaluation (NIST RMF-Based)

• Likelihood of Exploitation: 🔴 High / 🟡 Medium / 🟢 Low
• Impact on Device Functionality: 🔴 High / 🟡 Medium / 🟢 Low
• Impact on Patient Safety: 🔴 High / 🟡 Medium / 🟢 Low

4️⃣ Mitigation & Residual Risk Analysis

• Mitigation Actions: ____________________
• Risk Level After Mitigation: 🔴 High / 🟡 Medium / 🟢 Low
• Residual Risk Level: 🔴 High / 🟡 Medium / 🟢 Low

5️⃣ Response Plan & Next Steps

• Required Patch Updates: ____________________
• Compliance Documentation (FDA, NIST, ISO 14971): ____________________
• Ongoing Monitoring Measures (contaiment): ____________________
• Communication - Vulnerabilties Disclosure

5️⃣ Design Controls and Fix

• Design input, output, verification, validation, traceability
  • software specifications
  • Traceability
  • verification and validation (test cases / penetration testing)
  • Update security controls (threat modeling , gap analysis, architectural diagram)

🚨 Worksheet B: Cyber Incident Response Exercise

Participant Name: ____________________
Date: ______________
Incident Scenario: ____________________

1️⃣ Identification

• Source of Attack: (Network, Physical Access, Software Exploit, Insider Threat) ____________________
• Affected Systems: ____________________
• Detection Method: (SIEM Logs, IDS/IPS Alerts, User Reports) ____________________
• Threat Intelligence Feeds Used: (CISA, MITRE ATT&CK, ISAO, FDA Cyber Alerts) ____________________
• Vulnerability Disclosure & Reporting: ____________________

2️⃣ Containment

• Immediate Action Taken: ____________________
• Devices Isolated: Yes / No
• Access Revoked: Yes / No

3️⃣ Eradication & Recovery

• Root Cause Analysis Findings: ____________________
• Malware or Exploit Used: ____________________
• System Patching & Remediation: ____________________
• Restoration Procedure: ____________________

4️⃣ Incident Review & Lessons Learned

• How Could This Have Been Prevented? ____________________
• Additional Security Measures Required: ____________________
• Policy Updates Needed? Yes / No
• Training Improvement Recommendations: ____________________

---