TPS-to-linac plan integrity
The treatment plan delivered from TPS to linac is safety-critical writable state - any path that can substitute, modify, or replay a plan must be authenticated, integrity-protected, and audited end to end.
Cybersecurity for linacs, treatment planning systems, oncology information systems, and brachytherapy platforms.
Radiation oncology platforms - linacs, treatment planning systems (TPS), oncology information systems (OIS), and brachytherapy afterloaders - carry the most documented ransomware history of any medical device segment (Elekta cloud-storage incident, Varian/Siemens advisories, Universal Health Services and Sky Lakes outages). They combine safety-critical dose-delivery control with multi-day patient-treatment workflows that cannot tolerate downtime. We build premarket and postmarket cybersecurity packages tuned to the TPS-to-linac plan path, the OIS integration boundary, and the long deployed service lives of radiotherapy capital equipment.
The treatment plan delivered from TPS to linac is safety-critical writable state - any path that can substitute, modify, or replay a plan must be authenticated, integrity-protected, and audited end to end.
The OIS is the convergence point for scheduling, plans, imaging, and delivery records - the Elekta 2021 incident demonstrated that cloud-OIS outage halts treatment fleet-wide; segmentation and recovery plans are first-class deliverables.
Linacs and TPS hosts routinely run for 10-15 years on embedded OS versions that go EOL mid-deployment - the postmarket plan must document compensating controls and a defensible patch cadence under treatment-schedule constraints.
Vendor service tunnels and on-site physicist tooling have been the entry point in multiple public incidents - they're a continuous postmarket surface, not a one-time review.
Radiation-oncology platforms span the treatment planning system, the OIS (the convergence point for plans, imaging, scheduling, and delivery records), and the linac itself, with on-board imaging and brachytherapy afterloaders sharing the same trust chain. Vendor remote-service tooling has been the entry point in multiple public incidents.
Layers shown outermost (top) to innermost (bottom). Dashed rows are part of the surrounding system but out of scope for this view.
Radiation oncology carries the most documented ransomware and outage history of any medical device segment. Reviewers expect threat models that explicitly address the Elekta, UHS, and Sky Lakes incidents as design references, not as background context.
Historical incidents
A ransomware attack against Elekta's first-generation cloud-based storage system disrupted radiation-oncology operations at numerous cancer centers in North America for multiple days to weeks. The incident is the canonical reviewer reference for OIS / cloud-platform resilience and treatment-continuity planning in radiation oncology.
Elekta customer notification, April-May 2021Public reporting at affected cancer centers
The UHS ransomware event halted clinical operations - including radiation oncology - across the network for days, demonstrating fleet-wide impact when shared infrastructure underlying radonc is compromised. Reviewers cite this incident when assessing OIS segmentation and manual-fallback design.
UHS public statement, September-October 2020
Sky Lakes Medical Center disclosed a Ryuk ransomware incident that disrupted radiation-oncology treatments and forced manual rescheduling for weeks. The pattern is cited as a reference case for treatment-day RTO/RPO and the need for a usable manual-fallback workflow.
Sky Lakes Medical Center public statements, Oct-Nov 2020
Active threat scenarios
A treatment plan modified, substituted, or replayed on the path from TPS through OIS to the linac is a direct patient-safety hazard at the level of dose delivery; every hop needs authentication, integrity, and replay protection.
Elekta-class root cause: cloud-OIS outage halts treatment fleet-wide; absence of segmentation, RTO/RPO, manual fallback, and hospital-IR integration is a deficiency-letter pattern.
Vendor service tunnels and on-site physicist tooling have been the entry point in multiple public incidents - they belong in the postmarket plan as an ongoing surface, not a one-time premarket review.
Linacs run 10-15 years on embedded OS that reaches EOL mid-deployment; absence of a per-generation configuration matrix and compensating-controls plan is reviewer-visible.
What FDA reviewers cite
Radiation oncology carries the most documented ransomware and outage history of any medical device segment - the Elekta 2021 cloud-storage incident, the UHS and Sky Lakes outages, and multiple linac/OIS advisories define how the FDA and hospital procurement evaluate this category.
The treatment plan from TPS through OIS to linac is safety-critical writable state; every hop needs authentication, integrity, and replay protection validated against IEC 60601-2-1 essential performance.
Elekta 2021 demonstrated that cloud-OIS outage halts treatment fleet-wide; postmarket plans must document segmentation, RTO/RPO, manual-fallback workflow, and hospital-IR integration.
Linacs and TPS hosts run 10-15 years on embedded OS that goes EOL mid-deployment - per-generation configuration matrix and compensating controls are required deliverables.
Vendor tunnels and on-site physicist tooling have been the entry point in multiple public incidents and belong in the postmarket plan as an ongoing surface, not a one-time review.
Standards & deliverables
Six deliverables FDA and notified bodies expect across MedTech, with the radiation oncology-specific wrinkle on each row. Use it as a scoping checklist before you brief vendors or your QA team.
Machine-readable SBOM (CycloneDX/SPDX) plus VEX feed for every CVE that touches a listed component.
Continuous CVE / advisory monitoring against the SBOM, with a documented triage and disclosure path.
Black/grey-box testing across device, wireless interfaces, mobile apps, cloud APIs, and service tooling.
STRIDE-per-interface threat model with documented mitigations and residual-risk acceptance.
Signed firmware/software updates with rollback protection, integrity verification, and staged rollout.
Public CVD policy, intake channel, and SLAs for triage, fix, and customer communication.
Radiation oncology has the most documented ransomware and outage history of any medical device segment - the Elekta cloud-storage incident, the UHS and Sky Lakes outages, and multiple Varian/Siemens advisories define how the FDA and hospital procurement evaluate this category. Reviewers expect the threat model to enumerate plan-integrity, OIS resilience, and vendor remote-service paths explicitly, with positive evidence and a postmarket plan that addresses fleet recovery, not just individual-device patching.
We scope the entire chain: TPS export, transport (DICOM-RT or proprietary), OIS storage and retrieval, and on-linac verification. Each hop is exercised for authentication, integrity, replay, and substitution, and the device's behavior under tampered or malformed plans is validated against the IEC 60601-2-1 essential-performance bounds. Findings tie back to specific hazard entries in the risk file so safety and security teams act on the same evidence.
Yes. The OIS is scoped as the convergence point for treatment continuity. The postmarket plan documents segmentation between OIS and clinical-network zones, backup/restore RTO/RPO for treatment-day operations, the manual fallback workflow when OIS is unavailable, and the relationship to hospital-wide incident response. Reviewers and hospital security teams both expect this level of explicit operational planning after the public 2021 incident.
Linacs commonly run for 10-15 years on embedded OS versions that go EOL mid-deployment. The postmarket plan documents the configuration matrix per generation, the compensating controls (segmentation, allowlisting, restricted USB/service-port use), the patch cadence under treatment-schedule constraints, and the EOL/EOS communications plan. The matrix is referenced from the SPDF so reviewers and hospital biomed see the same story.
Brachytherapy afterloaders share the TPS-to-device plan integrity concern but add the source-position control loop under IEC 60601-2-17. Proton platforms add real-time gantry control under IEC 60601-2-68. Both are scoped alongside the linac model when applicable, with platform-specific essential performance called out separately.
For a linac platform with TPS, OIS integration, and IGRT, end-to-end premarket cyber work runs 14-18 weeks. Threat modeling and SBOM front-load in weeks 1-5, pen testing across linac, TPS, OIS, IGRT, and vendor remote-service runs in weeks 5-15, and the consolidated submission package and postmarket plan close in the final weeks - all under a written deficiency commitment.
TPS-to-linac plan integrity, OIS resilience and ransomware recovery, vendor remote-service tooling, and long-tenure embedded-OS strategy.
"Blue Goat Cyber's depth of expertise was impressive. We had no in-house cybersecurity experience, and their team guided us through every step of the FDA process. The penetration testing and SBOM testing were thorough and gave us complete confidence."
Cybersecurity for linacs, treatment planning systems, oncology information systems, and brachytherapy platforms.
