--- title: "MDS2 Definition & Meaning | MedTech Terms" description: "A standardized form by which device manufacturers disclose security characteristics to healthcare delivery organizations." lang: en json-ld: | { "@context": "https://schema.org", "@graph": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/mds2#term", "name": "Manufacturer Disclosure Statement for Medical Device Security", "alternateName": "MDS2", "description": "The Manufacturer Disclosure Statement for Medical Device Security (MDS2), maintained by the Healthcare Information and Management Systems Society (HIMSS) and aligned to IEC 80001-2-2, is a standardized questionnaire that manufacturers complete to disclose a connected device's security characteristics - authentication, encryption, audit controls, malware protection, network configuration, patch policy - to hospital procurement and security teams.", "url": "https://medtechterms.com/terms/mds2", "termCode": "mds2", "inDefinedTermSet": { "@type": "DefinedTermSet", "name": "MedTech Terms", "url": "https://medtechterms.com/terms" } }, { "@type": "Article", "@id": "https://medtechterms.com/terms/mds2#article", "headline": "MDS2, Manufacturer Disclosure Statement for Medical Device Security", "description": "A standardized form by which device manufacturers disclose security characteristics to healthcare delivery organizations.", "url": "https://medtechterms.com/terms/mds2", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://medtechterms.com/terms/mds2" }, "about": { "@id": "https://medtechterms.com/terms/mds2#term" }, "articleSection": "Cybersecurity", "inLanguage": "en", "keywords": "Manufacturer Disclosure Statement for Medical Device Security, MDS2, Cybersecurity, medical device, MedTech", "author": { "@type": "Person", "name": "Christian Espinosa", "jobTitle": "Founder, Blue Goat Cyber", "url": "https://bluegoatcyber.com" }, "publisher": { "@type": "Organization", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "isPartOf": { "@type": "WebSite", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "datePublished": "2026-05-05", "dateModified": "2026-05-05", "citation": [ { "@type": "CreativeWork", "name": "HIMSS MDS2", "url": "https://www.himss.org/resources/manufacturer-disclosure-statement-medical-device-security-mds2", "publisher": { "@type": "Organization", "name": "HIMSS" } }, { "@type": "CreativeWork", "name": "IEC TR 80001-2-2", "url": "https://www.iso.org/standard/57939.html", "publisher": { "@type": "Organization", "name": "ISO/IEC" } }, { "@type": "CreativeWork", "name": "HSCC - Health Sector Coordinating Council", "url": "https://healthsectorcouncil.org/", "publisher": { "@type": "Organization", "name": "HSCC" } } ], "mentions": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/iec-80001#term", "name": "IEC 80001-1", "url": "https://medtechterms.com/terms/iec-80001" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/section-524b#term", "name": "Section 524B of the FD&C Act", "alternateName": "524B", "url": "https://medtechterms.com/terms/section-524b" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/hscc-jsp#term", "name": "HSCC Joint Security Plan", "alternateName": "HSCC JSP", "url": "https://medtechterms.com/terms/hscc-jsp" } ] }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://medtechterms.com/" }, { "@type": "ListItem", "position": 2, "name": "Terms", "item": "https://medtechterms.com/terms" }, { "@type": "ListItem", "position": 3, "name": "Cybersecurity", "item": "https://medtechterms.com/terms?cat=Cybersecurity" }, { "@type": "ListItem", "position": 4, "name": "Manufacturer Disclosure Statement for Medical Device Security", "item": "https://medtechterms.com/terms/mds2" } ] }, { "@type": "FAQPage", "@id": "https://medtechterms.com/terms/mds2#faq", "mainEntity": [ { "@type": "Question", "name": "Is MDS2 required by FDA?", "acceptedAnswer": { "@type": "Answer", "text": "Not by name, but the cybersecurity labeling and operator-disclosure expectations in the 2023 guidance are routinely satisfied via MDS2." } }, { "@type": "Question", "name": "How often should we update MDS2?", "acceptedAnswer": { "@type": "Answer", "text": "At minimum: every release that changes a security-relevant characteristic. Many MedTech teams refresh MDS2 annually as a baseline and on every security-relevant change." } }, { "@type": "Question", "name": "Where do hospitals use MDS2?", "acceptedAnswer": { "@type": "Answer", "text": "Procurement, network onboarding, and post-market vulnerability response. Some HDO security programs require MDS2 before any device touches the network." } } ] } ] } --- [ MedTech Terms The authoritative reference ](/) Browse Learn [Latest](/latest) About 1. [Home](/) 2. / 3. [Terms](/terms) 4. / 5. [Cybersecurity](/terms?cat=Cybersecurity) 6. / 7. Manufacturer Disclosure Statement for Medical Device Security [All terms](/terms) Cybersecurity [Connected & Cyber-Physical Devices](/ecosystems/connected-devices)MDS2 # Manufacturer Disclosure Statement for Medical Device Security A standardized form by which device manufacturers disclose security characteristics to healthcare delivery organizations. Reviewed by [Christian Espinosa, Founder, Blue Goat Cyber](/authors/christian-espinosa) Last reviewed May 5, 2026 ## Definition The Manufacturer Disclosure Statement for Medical Device Security (MDS2), maintained by the Healthcare Information and Management Systems Society (HIMSS) and aligned to IEC 80001-2-2, is a standardized questionnaire that manufacturers complete to disclose a connected device's security characteristics - authentication, encryption, audit controls, malware protection, network configuration, patch policy - to hospital procurement and security teams. What the regulation says FDA's 2023 guidance expects manufacturers to provide security disclosure to operators; MDS2 is the de-facto industry-standard format. MDS2 is referenced in HSCC and AHA guidance and frequently required by hospital procurement contracts. ## What this means in practice MDS2 sits at the manufacturer-HDO handoff and is one of the highest-leverage documents a security program produces. A well-completed, current MDS2 directly accelerates hospital procurement; a stale or incomplete MDS2 stalls deals. Mature MedTech teams maintain MDS2 as a living document tied to each release. Common pitfalls - • Treating MDS2 as a marketing document - overstating capabilities backfires in operator audits. - • Letting MDS2 go stale across releases. - • Not aligning MDS2 to MDS2-2019 (the current version) - older versions miss key security characteristics. ## Frequently asked questions Is MDS2 required by FDA? Not by name, but the cybersecurity [labeling](/terms/labeling) and operator-disclosure expectations in the 2023 guidance are routinely satisfied via MDS2. How often should we update MDS2? Where do hospitals use MDS2? ## Cross-references ### See also Closely related context worth reading. - [ Premarket Cybersecurity Submission ](/terms/premarket-cybersecurity) ## Related terms Grouped by theme ### Editor's picks · Hand-selected related concepts [ Cybersecurity HSCC Joint Security Plan(HSCC JSP) An industry-developed reference framework from the Healthcare Sector Coordinating Council for end-to-end MedTech cybersecurity. ](/terms/hscc-jsp)[ Cybersecurity IEC 80001-1 International standard for risk management of IT networks that incorporate medical devices. ](/terms/iec-80001)[ Cybersecurity Section 524B of the FD&C Act(524B) The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices. ](/terms/section-524b) ### More in Cybersecurity · Same category [ Cybersecurity AAMI SW96 AAMI/ANSI standard establishing requirements for medical-device cybersecurity activities throughout the lifecycle. ](/terms/aami-sw96)[ Cybersecurity AAMI TIR57 AAMI Technical Information Report providing MedTech-specific guidance on cybersecurity risk management. ](/terms/aami-tir57)[ Cybersecurity AAMI TIR97(TIR97) AAMI Technical Information Report on post-market security risk management for medical device manufacturers, the operational companion to TIR57. ](/terms/aami-tir97)[ Cybersecurity Brainjacking Unauthorized remote control of an implanted neurostimulator (e.g., DBS) to alter stimulation parameters and harm a patient. ](/terms/brainjacking) Cited by Where this term appears across MedTech Terms. Ecosystems (1) - [Connected & Cyber-Physical Devices](/ecosystems/connected-devices) ## Primary references 3 sources Link health: 3 verified · last checked 2026-06-20 HIMSS· 1 ISO/IEC· 1 HSCC· 1 1. [1 HIMSS MDS2 Verified HIMSS · himss.org ](https://www.himss.org/resources/manufacturer-disclosure-statement-medical-device-security-mds2) 2. [2 IEC TR 80001-2-2 Verified ISO/IEC · iso.org ](https://www.iso.org/standard/57939.html) 3. [3 HSCC - Health Sector Coordinating Council Verified HSCC · healthsectorcouncil.org ](https://healthsectorcouncil.org/) Inline markers like \[1\] jump to the matching reference above. Sponsor note ### Working on medical device cybersecurity? Blue Goat Cyber specializes in MedTech cybersecurity - threat modeling, SBOMs, penetration testing, and FDA premarket submissions. [Book a 30-minute discovery session](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session) - No obligation - Expert-led from minute one - NDA available on request MedTech Terms is a community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com). Definitions are independent of any vendor. On this term Category Cybersecurity Acronym MDS2 Sources 3 Updated 5/5/2026 [Compare with another term](/compare?a=mds2) Learn in 60 seconds Card Lesson Quiz A standardized form by which device manufacturers disclose security characteristics to healthcare delivery organizations. - · MDS2 sits at the manufacturer-HDO handoff and is one of the highest-leverage documents a security program produces. - · A well-completed, current MDS2 directly accelerates hospital procurement; a stale or incomplete MDS2 stalls deals. - · Mature MedTech teams maintain MDS2 as a living document tied to each release. Remember this Watch out: Treating MDS2 as a marketing document - overstating capabilities backfires in operator audits. Related terms - [IEC 80001-1 ](/terms/iec-80001) - [Section 524B of the FD&C Act(524B) ](/terms/section-524b) - [HSCC Joint Security Plan(HSCC JSP) ](/terms/hscc-jsp) You may also need Auto-suggested from Cybersecurity and shared keywords. - [AAMI TIR97(TIR97) ](/terms/aami-tir97) - [Medhacking ](/terms/medhacking) - [Legacy Device Cybersecurity ](/terms/legacy-device-cyber) - [NIST Cybersecurity Framework(NIST CSF) ](/terms/nist-csf) - [Threat Modeling ](/terms/threat-modeling) - [AAMI SW96 ](/terms/aami-sw96) [All Cybersecurity terms](/terms?cat=Cybersecurity) From the Blue Goat network Related resources and services on this topic. - [ MedTech Cybersecurity Standards Authoritative reference for the standards and guidances behind medical device cybersecurity. ](https://medtechcyberstandards.com) - [ MedTech Cyber Tips Practical, organized tips for medical device cybersecurity teams. ](https://medtechcybertips.com) - [ MedTech Cybersecurity Crosswalk International crosswalk of medical device cybersecurity requirements across regulators. ](https://mdccrosswalk.com) - [ Code Blue Real medical device cybersecurity incidents and their lessons. ](https://codebluechart.com) MedTech Terms An authoritative, plain-language reference for the regulatory, quality, cybersecurity, and software terms that shape modern medical devices. Browse - [All terms](/terms) - [A–Z index](/a-z) - [Categories](/categories) - [Ecosystems](/ecosystems) - [Learning paths](/paths) - [Compare terms](/compare) - [Quiz](/quiz) Resources - [FDA Medical Devices](https://www.fda.gov/medical-devices) - [EU MDR](https://eur-lex.europa.eu/eli/reg/2017/745/oj) - [IMDRF](https://www.imdrf.org/) - [Methodology](/methodology) - [Changelog](/changelog) - [Editor: Christian Espinosa](/authors/christian-espinosa) - [About this site](/about) © 2026 MedTech Terms. Reference content for educational purposes - not regulatory advice. A community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com)