Skip to content

Moraph for clients

Sign in

Reference

Medical Device Cybersecurity Hub glossary

Terms used in Medical Device Cybersecurity Hub and its documentation.

Applies to Medical Device Cybersecurity Hub as it works today. Moraph updates the platform continuously, and this page is reviewed when it changes.

Last reviewed 1 min readReport a problem

Terms used in Medical Device Cybersecurity Hub and its documentation.

TermMeaning
CMMSComputerized maintenance management system, where clinical engineering keeps asset tags, models, locations and maintenance history.
Reconciliation queueDevices seen on the network but missing from CMMS records, or records whose details conflict, waiting for someone to resolve them.
FindingA vulnerability or advisory that an analyst has confirmed applies to a device.
False matchA suggested vulnerability match that an analyst rejected because the device is not actually affected.
KEVThe CISA Known Exploited Vulnerabilities catalog, which lists vulnerabilities known to be exploited.
Compensating controlA measure such as network segmentation or access restriction that reduces risk while a device cannot be patched.
Risk acceptanceA documented decision to accept the risk of a finding that cannot be remediated, with approvers, conditions and an expiry date.
MDS2Manufacturer Disclosure Statement for Medical Device Security, a standard form describing a device's security features.
SBOMSoftware bill of materials, a list of the software components in a device, used to match components to vulnerabilities.
End of supportSoftware or an operating system that the manufacturer no longer updates or supports.

Was this page helpful?

Report a problem with this page
What’s the problem?
Quote the step or heading if you can. Don’t include passwords or personal records.
Only if you’d like a reply. We use it for this report and nothing else.

Need help with your own setup rather than this page? Raise a support ticket.