Cybersecurity Risk Assessor Skill

Purpose

The Cybersecurity Risk Assessor Skill evaluates cybersecurity risks for medical devices per FDA guidance and IEC 81001-5-1, supporting threat modeling, vulnerability assessment, and security control implementation.

Capabilities

• Threat modeling (STRIDE methodology)
• Vulnerability assessment
• SBOM (Software Bill of Materials) generation
• Security control identification
• Penetration testing planning
• Cybersecurity documentation for FDA submissions
• Attack surface analysis
• Security architecture review
• Coordinated vulnerability disclosure planning
• Postmarket cybersecurity management
• Patch management planning

Usage Guidelines

When to Use

• Assessing device cybersecurity risks
• Planning penetration testing
• Preparing FDA cybersecurity submissions
• Managing software dependencies

Prerequisites

• Software architecture documented
• Network connectivity defined
• Data flows identified
• Third-party components cataloged

Best Practices

• Integrate cybersecurity from design inception
• Maintain current SBOM
• Plan for security updates throughout lifecycle
• Establish vulnerability disclosure process

Process Integration

This skill integrates with the following processes:

• Software Development Lifecycle (IEC 62304)
• Medical Device Risk Management (ISO 14971)
• 510(k) Premarket Submission Preparation
• Post-Market Surveillance System Implementation

Dependencies

• FDA Cybersecurity guidance
• IEC 81001-5-1 standard
• SBOM tools (CycloneDX, SPDX)
• Vulnerability databases (NVD, CVE)
• Threat modeling frameworks

Configuration

cybersecurity-risk-assessor:
  threat-methodologies:
    - STRIDE
    - PASTA
    - attack-trees
  sbom-formats:
    - CycloneDX
    - SPDX
  security-tiers:
    - Tier-1-higher
    - Tier-2-standard
  control-frameworks:
    - NIST-CSF
    - IEC-62443

Output Artifacts

• Threat models
• Vulnerability assessments
• SBOM documents
• Security architecture documents
• Penetration test plans
• FDA cybersecurity submissions
• Security control matrices
• Patch management plans

Quality Criteria

• All threat vectors identified
• Vulnerabilities assessed with CVSS scores
• SBOM is complete and current
• Security controls address identified risks
• Documentation meets FDA requirements
• Postmarket security plan established