Working Group Details
HDSecWG - Healthcare Device Security Assurance Working Group
|IEEE Program Manager|
P2621.1 - Standard for Wireless Diabetes Device Security Assurance: Product Security Evaluation Program
This standard defines a framework for a connected electronic product security evaluation program, which includes: 1. How to apply the ISO/IEC 15408 security evaluation framework in a security evaluation program defined by this standard. 2. Framework for authorizing independent testing labs to be used in the security evaluation program. 3. Framework for certifying results from authorized labs. 4. Framework for defining and approving new security requirements and changes to security requirements, via protection profiles and security targets, to be used in the security evaluation program. 5. Framework for assuring continued maintenance of assurance post-certification.
P2621.2 - Standard for Wireless Diabetes Device Security Assurance: Protection Profile for Connected Diabetes Devices
This standard describes the security requirements, which compose a Protection Profile, for connected diabetes devices (CDDs). This standard includes: 1. Identification of relevant threats to CDDs and derivation of security objectives that counter those threats. 2. Derivation, from the security objectives, of security requirements for CDDs, taking into account the need to balance security and safe clinical application. 3. As part of that balance, differentiation between mandatory and optional requirements and specification of objectives that must be handled by the CDDs deployment environment rather than the CDD itself. 4. As part of that balance, definition of multiple levels of assurance requirements, enabling certification bodies and other stakeholders to apply a level of independent evaluation rigor that meets the collective and often varying needs across disparate situations, deployments, treatment criticality, and device type. 5. In order to be most useful for a broad audience of stakeholders, an informative layperson's explanation of CDD security requirements, in addition to the formal, normative requirements that follow the standardized requirements definition framework of ISO/IEC 15408.