The threat model and Threat Table identify what can go wrong and trace each threat to a control, a test, and a patient harm.
Part of Medical device threat modeling services.
External entities, processes, data stores, and data flows, with trust boundaries drawn as closed shapes.
Each numbered interface, its protocol and version, and the trust boundary it crosses.
Every in-scope element walked through spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege.
One each for confidentiality, integrity, and availability. Each root is a patient-relevant goal. Each leaf maps to a Threat Table row.
At least eight columns. Carries the initial, pre-control risk and the named mitigation for every threat.
Links each threat to its control, its test case, and the manufacturer-supplied patient harm.
The fewest columns that make a row defensible. A Status column (Open or Closed) tracks each row over time.
An Excel workbook with the eight columns plus Status, drop-down lists for element, risk, strategy, and status, and an Entry Points sheet. It contains no sample threats. The FDA does not mandate a template, so adapt it to your QMS.
Download template (.xlsx)The threat model includes its own data flow diagrams and trust boundaries. Those are not the security architecture views.
