MDS2 (Medical Device) SGUD: SGUD Security guidance: disclose owner and operator security documentation, data sanitisation, account documentation and recommended compensating controls

Discloses the availability of security guidance for the device's operators and administrators and for the manufacturer's sales and service: whether security documentation for the owner or operator is included, whether as a dedicated document or within the user or service manuals (SGUD-1); whether the device can remove data permanently from the device or its media, with instructions and the specification followed such as HMG InfoSec Standard 5, BSI or NIST SP 800-88 (SGUD-2); whether all access accounts are documented (SGUD-3), including every remote-access account or facility such as RDP or IPMI, and whether the owner or operator can manage passwords for all accounts, enabling, disabling and changing them (3.1); and whether the product includes documentation of recommended compensating controls for the device (SGUD-4).