FDA MDDT for Cybersecurity: Using the CVSS Rubric for Devices

Two teams can score the same medical device vulnerability and get very different numbers. One treats the device like a laptop. The other thinks about the patient.

That gap causes real problems. It confuses hospitals, slows coordinated disclosure, and makes postmarket decisions hard to defend.

On October 20, 2020, the FDA qualified the MITRE Rubric for Applying the Common Vulnerability Scoring System (CVSS) to Medical Devices as a Medical Device Development Tool. The FDA also recognized CVSS v3.0 as a consensus standard. Together, they give manufacturers, researchers, hospitals, and regulators a shared way to talk about severity.

This article explains what the MDDT program is, what the rubric does, and how to use it without overstating what it proves.

Why This Matters

Severity scoring drives postmarket decisions. It shapes how fast a team patches, what it tells customers, and how it explains choices to the FDA.

The FDA's Postmarket Management of Cybersecurity in Medical Devices (December 28, 2016) asks manufacturers to assess exploitability and severity of patient harm. The FDA's Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 3, 2026) expects a documented security risk assessment and vulnerability handling process.

According to MITRE, CVSS and its examples were built for enterprise IT and do not adequately reflect the clinical environment or patient safety impacts. That is the gap the rubric was created to close.

Using a qualified tool helps reviewers and customers trust that scoring followed a recognized method. Related standards include ISO 14971 for safety risk management, AAMI TIR57 for security risk management, and IEC 81001-5-1 for vulnerability handling in health software. Newer scoring versions such as CVSS 4.0 exist, but the qualified rubric targets CVSS v3.0.

What Is the FDA MDDT Program?

The MDDT program is the FDA's way to qualify tools that sponsors can use in developing and evaluating devices. A qualified tool has been reviewed for a stated context of use, so sponsors can rely on it without re-proving it in each submission.

The program covers three broad tool types: clinical outcome assessments, biomarker tests, and nonclinical assessment models. The cybersecurity rubric is a nonclinical assessment model.

[FDA LANGUAGE] The FDA states that qualification of an MDDT is different from marketing authorization of a medical device. A qualified tool helps make product evaluation more predictable. It does not clear or approve the device it is used on.

The context of use matters. The rubric is qualified for scoring medical device vulnerabilities with CVSS v3.0. Using it for other purposes, or with other scoring systems, moves outside what the FDA reviewed.

What Does the MITRE CVSS Rubric Do?

The rubric turns CVSS scoring into a series of structured questions. Each part of the CVSS vector has its own decision points, and the answers suggest which metric values to choose.

According to the FDA's summary of evidence for the tool, when an answer suggests the vulnerability might affect patient safety, the rubric flags it so the analyst considers a safety-oriented hazard analysis. That is the bridge between security scoring and safety risk management.

[KEY REQUIREMENT] Record every answer. The value of the rubric is the reasoning it captures, not just the final number.

What Are the Limits of the CVSS Rubric?

See also: When to Patch a Medical Device Vulnerability: FDA Rules (2026), Vulnerability Management Metrics for Medical Device Manufacturers (2026), and Is a PHI Breach Patient Harm? How the FDA Views Device Data Confidentiality.

The rubric produces a severity score, not a risk decision. It does not tell you whether residual patient risk is acceptable or how fast to patch.

Three limits come up often. First, it is built for CVSS v3.0, so teams that also report CVSS 4.0 need to map results carefully. Second, environmental factors vary by hospital, so one score may not fit every deployment. Third, patient harm severity comes from your ISO 14971 work, not from the rubric.

Use the rubric as one input in a documented risk method. Pair it with exploitation evidence, such as a CISA KEV listing, and with your safety analysis. Then make the controlled or uncontrolled risk call.

Need help building a scoring method reviewers can follow? Our medical device threat modeling services connect vulnerability scoring to safety risk.

How Blue Goat Cyber Approaches This

We score vulnerabilities the way the rubric intends: with recorded answers and clear assumptions. For each finding, we document the device interfaces involved, the access an attacker needs, and the evidence behind each CVSS metric.

We keep severity and risk separate. Our documented exploitability method and security matrices feed a risk call, and your ISO 14971 safety inputs set patient harm severity. Where a finding may affect patient safety, we flag it for the manufacturer's hazard analysis rather than assigning harm ourselves.

Our penetration test reports use CVSS 4.0 alongside ISO 14971 harm severity. When a client or customer also needs a CVSS v3.0 score using the MITRE rubric, we provide it with the rubric answers attached.

The manufacturer owns risk acceptance and regulatory decisions. Blue Goat track record: 275+ FDA submissions supported, zero cybersecurity rejections. Learn more about our FDA premarket cybersecurity services.

Frequently Asked Questions

CTA

Want vulnerability scores your reviewers and hospital customers can trust? Read our guide to CVSS 3.1 vs 4.0 for medical devices to see how scoring versions affect your records.