MDS2 (Medical Device) SAHD: SAHD System and application hardening: disclose hardening standards, certification, integrity checking, access control, disabled accounts, ports, services and boot protection

Discloses how well the device withstands cyber attack and malware: hardening to industry standards (SAHD-1); any cybersecurity certification received (SAHD-2); mechanisms for software integrity checking (SAHD-3), confirming that installed software is manufacturer-authorised through release-specific hash keys, checksums or digital signatures (3.1) and that software updates are manufacturer-authorised (3.2); whether the owner or operator can run software integrity checks to show that nothing in the system has been altered or tampered with, with typical output (SAHD-4); file-level, patient-level or other access control (SAHD-5) and role-based access control (5.1); whether the manufacturer restricts or disables system or user accounts on delivery (SAHD-6), whether the end user can still configure any of them once set-up is complete (6.1), and whether specific accounts such as service technicians are limited to least-privilege access (6.2); whether shared resources such as file shares not needed for the intended use are disabled (SAHD-7), communication ports and protocols not needed are disabled (SAHD-8), services not needed such as Telnet, FTP or IIS are removed or disabled (SAHD-9), and applications not needed, both COTS and those bundled with the operating system such as a web browser, are removed or disabled (SAHD-10), each with a note on whether this is done by the manufacturer at delivery or left to the end user; whether booting from uncontrolled or removable media is prevented (SAHD-11); whether unauthorised software or hardware can be installed without physical tools (SAHD-12); whether the documentation covers the user running operational network security scans (SAHD-13); whether the device can be hardened beyond its default state (SAHD-14) with vendor instructions for doing so (14.1); whether access to the BIOS or other bootloaders during boot can be prevented (SAHD-15); and whether hardening methods beyond this section were used (SAHD-16).