| 524B | Section 524B of the FD&C Act | The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices. |
| ATT&CK | MITRE ATT&CK | Knowledge base of real-world adversary tactics, techniques, and procedures organized into a matrix used to model threats and assess defenses. |
| CVD | Coordinated Vulnerability Disclosure | A documented process for receiving, triaging, and responsibly disclosing security vulnerabilities reported by external researchers. |
| CVE | Common Vulnerabilities and Exposures | A globally unique identifier for a publicly disclosed cybersecurity vulnerability. |
| CVSS | Common Vulnerability Scoring System | An industry-standard 0–10 score that quantifies the severity of a software vulnerability. |
| CWE | Common Weakness Enumeration | Community-maintained list of software and hardware weakness types, the underlying defects that cause CVEs. |
| D3FEND | MITRE D3FEND | MITRE's knowledge graph of defensive cybersecurity countermeasures, explicitly mapped to the ATT&CK techniques they mitigate. |
| FedRAMP | FedRAMP | U.S. government-wide program that standardizes security assessment, authorization, and continuous monitoring for cloud services sold to federal agencies. |
| H-ISAC | Health Information Sharing and Analysis Center | Member-driven nonprofit that operates the trusted sharing community for cyber and physical threat intelligence across the healthcare sector. |
| HICP | Health Industry Cybersecurity Practices | Consensus cybersecurity practices for healthcare published under HHS Section 405(d), the recognized 'reasonable practices' safe-harbor reference. |
| HIPAA | HIPAA | U.S. federal law governing the privacy and security of protected health information. |
| HITECH | HITECH Act | U.S. law that strengthened HIPAA enforcement and introduced breach-notification requirements. |
| HITRUST | HITRUST CSF | Healthcare-focused certifiable security framework that consolidates HIPAA, NIST, ISO 27001, and other authorities into a unified control set. |
| HPH-CPG | Healthcare and Public Health Cybersecurity Performance Goals | HHS's sector-specific list of essential and enhanced cybersecurity goals for healthcare, derived from HICP and the NIST CSF. |
| HRoT | Hardware Root of Trust | A tamper-resistant hardware element (TPM, secure element, or fused boot ROM) that provides the foundational, unforgeable trust anchor for secure boot, attestation, and key storage. |
| HSCC JSP | HSCC Joint Security Plan | An industry-developed reference framework from the Healthcare Sector Coordinating Council for end-to-end MedTech cybersecurity. |
| ICSMA | ICS Medical Advisory | CISA's official vulnerability advisories for medical devices, the public record of disclosed device cybersecurity issues, indexed as ICSMA-YY-DDD-NN. |
| ISO 27001 | ISO/IEC 27001 | International standard for information security management systems (ISMS), often required of MedTech vendors by enterprise customers. |
| KEV | CISA Known Exploited Vulnerabilities Catalog | CISA's authoritative list of CVEs with confirmed in-the-wild exploitation, with mandatory federal remediation deadlines. |
| MDS2 | Manufacturer Disclosure Statement for Medical Device Security | A standardized form by which device manufacturers disclose security characteristics to healthcare delivery organizations. |
| NIST 800-53/171 | NIST SP 800-53 / 800-171 | Federal control catalogs (800-53) and CUI-handling requirements (800-171) often referenced in MedTech contracts. |
| NIST CSF | NIST Cybersecurity Framework | A risk-based framework of cybersecurity functions and outcomes published by NIST and widely used to organize MedTech security programs. |
| NIST IR 8473 | NIST IR 8473, Cybersecurity Framework Profile for HPH | NIST's Cybersecurity Framework profile tailored to the Healthcare and Public Health sector, translates NIST CSF outcomes into HPH-specific subcategories and references. |
| OTA | Over-the-Air Updates | Remote, network-delivered software or firmware updates to a fielded medical device. |
| RTA (cyber) | Refuse to Accept (Cybersecurity) | FDA's authority to reject a premarket submission outright when required cybersecurity content is missing. |
| SBOM | Software Bill of Materials | A machine-readable inventory of all software components, including open-source and third-party libraries, used to build a medical device. |
| SLSA | Supply-chain Levels for Software Artifacts | OpenSSF framework defining progressive levels of build-system integrity for software supply chain security, focused on tamper-resistance of the build. |
| SPDF | Secure Product Development Framework | A documented, risk-based set of processes that build cybersecurity into a medical device across its full lifecycle. |
| SPDX | SPDX | An open SBOM and license-data format published as ISO/IEC 5962:2021. |
| SSDF | Secure Software Development Framework | NIST SP 800-218, a framework of secure software development practices that is referenced by EO 14028 and increasingly by medical device guidance. |
| STRIDE | STRIDE Threat Model | A six-category framework for enumerating threats: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege. |
| TIR97 | AAMI TIR97 | AAMI Technical Information Report on post-market security risk management for medical device manufacturers, the operational companion to TIR57. |
| VEX | Vulnerability Exploitability eXchange | A machine-readable statement that explains whether a known vulnerability is actually exploitable in a specific product. |
| ZTA | Zero Trust Architecture | A security model that authenticates and authorizes every access, regardless of network location. |