Getting started with Medical Device Cybersecurity Hub

The Medical Device Cybersecurity Hub keeps one inventory of the connected medical devices in your hospitals, built from your clinical engineering records and network discovery tools. It matches each device to published vulnerabilities and manufacturer advisories, tracks patch status and compensating controls, and routes remediation and risk-acceptance decisions to the right people. Clinical engineering, security and clinical departments work from the same record, with the evidence kept for auditors and your risk committee.

What it is for

Most hospitals track infusion pumps, imaging systems, monitors and lab analyzers in a clinical engineering system that knows the asset tag and maintenance history but not the software version or network exposure, while the security team sees IP addresses with no idea what clinical device sits behind them. Manufacturer advisories arrive by email, patches can only be applied once the manufacturer has validated them, and many devices run operating systems that are no longer supported. When a new vulnerability is published, nobody can say quickly which devices are affected, where they are, or what has been done to protect them.

• Clinical engineering and security keep separate, incomplete device lists
• Advisories and vulnerabilities are matched to devices by hand, if at all
• Patch status, compensating controls and manufacturer approval are tracked in spreadsheets
• Risk acceptance for devices that cannot be patched is rarely documented or reviewed

Who uses it

• Clinical engineering and healthcare technology management teams
• Medical device and IoMT security analysts in the information security team
• CISOs and IT risk leaders who answer for device risk
• Clinical department and biomedical leaders who own the devices and approve downtime
• Supply chain and procurement teams who review device security before purchase

Before you start

• Your organization licenses Medical Device Cybersecurity Hub from Moraph.
• A Moraph client account in that organization, signed in.
• Access to Medical Device Cybersecurity Hub in Moraph Apps, given by an administrator in the Moraph Portal under People and access.
• For setup: the product administrator role.

Steps to get started

1. Sign in at app.moraph.com with your Moraph account.

2. Open Medical Device Cybersecurity Hub from the launcher. The first time anyone opens it, its workspace is created from the default described in Workspace reference.

3. Check your role: what you can see and do depends on it. See Roles and permissions.

4. Product administrators: work through Set up Medical Device Cybersecurity Hub before your team starts.

5. Everyone else: start with Everyday tasks.

Where to go next

• Set up Medical Device Cybersecurity Hub
• Everyday tasks
• Connect your systems
• Security, data and compliance
• Troubleshooting and the support guide
• Product overview on moraph.com