[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-488835-105":59,"doc-detail-488835-en":130},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":123,"head_meta":125,"extra_data":127,"updated_unix":129},105,"en","medical-product-manufacturer-cyber-incident-response-playbook-mpm-cirp-november-2024","Medical Product Manufacturer Cyber Incident Response Playbook (MPM CIRP) - November 2024","","Medical Product Manufacturer Cyber Incident Response Playbook (MPM CIRP) provides step-by-step guidance for medical product manufacturers to prepare for, detect, investigate, contain, eradicate, and recover from manufacturing-focused cyber incidents. It outlines how to build an incident response plan and procedures, establish a CIRT, document business-critical assets, and define severity classification. It also covers strategic communication, legal reporting obligations, evidence handling, and post-incident activities including after-action reviews and recovery planning.",{"@graph":69,"@context":122},[70,84,105],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":35,"@type":76,"position":81},"https://docshare.wps.com/document/healthcare/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/medical-product-manufacturer-cyber-incident-response-playbook-mpm-cirp-november-2024/488835/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/medical-product-manufacturer-cyber-incident-response-playbook-mpm-cirp-november-2024/488835.png","ImageObject",300,407,{"name":92,"@type":93},"Ben ","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-11-09","2026-10-01",true,{"@type":102,"interactionType":103,"userInteractionCount":52},"InteractionCounter",{"@type":104},"ViewAction",{"@type":106,"mainEntity":107},"FAQPage",[108,114,118],{"name":109,"@type":110,"acceptedAnswer":111},"What does the MPM CIRP focus on for medical product manufacturers?","Question",{"text":112,"@type":113},"It focuses on responding to manufacturing cyber incidents affecting medical products such as devices, drugs, and biologics. Guidance covers the full response lifecycle from preparation through recovery and post-incident activity.","Answer",{"name":115,"@type":110,"acceptedAnswer":116},"Which phases of cyber incident response are included in the playbook?",{"text":117,"@type":113},"The playbook addresses preparedness; detection, investigation, and analysis; containment; eradication; and recovery and post-incident activity. Each phase includes practical recommendations and processes.",{"name":119,"@type":110,"acceptedAnswer":120},"How does the playbook handle communication and legal obligations during incidents?",{"text":121,"@type":113},"It provides procedures for strategic communication and for legal response, including reporting incident information as required by laws, regulations, and contracts. It also outlines federal cyber incident reporting obligations and related insurance contract requirements when applicable.","https://schema.org",{"og:url":83,"og:type":124,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":126,"canonical":83},"index,follow",{"doc_id":128,"site_id":62},488835,1791102158,{"code":4,"msg":5,"data":131},{"doc_id":128,"user_id":132,"nickname":92,"user_avatar":133,"doc_module":4,"category_id":34,"category_name":35,"doc_title":65,"doc_description":67,"doc_content":134,"file_id":135,"file_url":136,"file_type":137,"file_size":138,"view_count":52,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":139,"language":140,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":141,"faqs":142,"seo_title":143,"seo_description":67,"update_tm":144,"read_time":145,"preview_page_count":4},2336478951081,"https://ap-avatar.wpscdn.com/davatar_276721f389ce27ea32af1340a28f341c","HEALTH INDUSTRY CYBERSECURITY  \nMedical Product Manufacturer Cyber Incident Response Playbook (MPM CIRP)  \nNOVEMBER 2024  \n\n| Table of Contents |  |\n| --- | --- |\n| Executive Summary | 4 |\n| About the Health Sector Coordinating Council Joint Cybersecurity Working Group | 5 |\n| Introduction | 5 |\n| How to Use the Playbook | 6 |\n| Summary of Cyber Incident Response Phases | 6 |\n| Preparation: Building a Cyber Incident Response Plan and Procedures | 6 |\n| Establish a Cyber Incident Response Team (CIRT) | 7 |\n| Identify, Develop, and Document Response Personnel and Partners | 11 |\n| Compile Key Documentation of Business-Critical Networks and Systems | 12 |\n| Develop Technical Response Procedures for Incident Handling | 13 |\n| Maintain Procedures to Classify the Severity of Cyber Incidents | 13 |\n| Develop Strategic Communication Procedures | 14 |\n| Develop Legal Response Procedures | 15 |\n| Obtain Buy-In and Sign-Off from Senior Leadership | 15 |\n| Exercise the Plan, Train Staff, and Update the Plan Regularly | 15 |\n| Identifying and Digging Deeper: Detecting, Investigating, and Analyzing Incidents | 15 |\n| Establish a Clear Process for Identifying and Reporting Cyber Alerts | 17 |\n| Investigate and Declare a Cyber Incident | 19 |\n| Engaging Help: Activating the Response Team and Engaging Resources | 20 |\n| Activate the Cyber Incident Response Team | 20 |\n| Engage Expert Response Resources | 21 |\n\nTake Action: Containment and Eradication 21  \nConduct Initial Containment Actions 21  \nCarefully Capture and Document Incident Information 22  \nExecute Evidence Gathering, Handling, and Preservation Procedures 23  \nReport the Incident as Required by Laws, Regulations, and Contracts 24  \n1. Federal Cyber Incident Reporting Obligations 25  \n2. Cyber Insurance Contract Requirements (if applicable) 27  \nDevelop Response Solutions and Assess Resource Needs 28  \nEnact the Response Plan and Eradicate the Threat 28  \n\n| Incident Recovery and Post Incident Activity | 28 |\n| --- | --- |\n| Recover from an Incident | 28 |\n| Conduct After-Action Review | 29 |\n| 1. Internal Considerations and Actions | 29 |\n| 2. External Considerations and Actions | 30 |\n| Appendix A: Resource Matrix and Additional Resources | 30 |\n| Matrix of Example Sector Resources | 30 |\n| Additional Cyber Incident Response Related Readings and Resources | 33 |\n\nAcknowledgements 33  \nExecutive Summary  \nMedical products−from medical devices, drugs, and biologics to durable equipment and other products−are critical to the delivery of healthcare and public health services. In the increasingly digital world, the manufacturers of these essential products have embraced digital technologies and systems to improve efficiency, reliability, productivity, and other aspects of the medical product processes. However, this increased connectivity and integration comes with cyber risks that may disrupt the manufacturing and operations for these products—cyber risks and associated impacts manufacturers should be prepared to respond.  \nConsequently, the Healthcare Sector Coordinating Council’s Manufacturing Operational Technology Cybersecurity Task Group—a joint collaborative between government, medical product manufacturers, and other stakeholders to advance manufacturing cybersecurity best practices and resources—sought to develop a resource to address this need and evolving landscape.  \nThe Medical Product Manufacturer Cyber Incident Response Playbook (MPM CIRP) is a comprehensive guide that provides information, step-by-step recommendations, and processes for medical product manufacturers to use in responding to manufacturing cyber incidents.  \nThe MPM CIRP details information and recommendations for stakeholders involved in the production of medical products (e.g., medical devices, pharmaceuticals, biologics)—known as medical product manufacturers. MPM CIRP covers, among other things:  \n• Detailed recommendations for medical product manufacturers across the following phases of cyber incident ","cbCaidZIU2vyaTiC","https://ap.wps.com/l/cbCaidZIU2vyaTiC","pdf",1749068,34,"English","# Executive Summary\n## About the Health Sector Coordinating Council Joint Cybersecurity Working Group\n## Introduction\n## How to Use the Playbook\n## Summary of Cyber Incident Response Phases\n# Preparation: Building a Cyber Incident Response Plan and Procedures\n## Establish a Cyber Incident Response Team (CIRT)\n## Identify, Develop, and Document Response Personnel and Partners\n## Compile Key Documentation of Business-Critical Networks and Systems\n## Develop Technical Response Procedures for Incident Handling\n## Maintain Procedures to Classify the Severity of Cyber Incidents\n## Develop Strategic Communication Procedures\n## Develop Legal Response Procedures\n## Obtain Buy-In and Sign-Off from Senior Leadership\n## Exercise the Plan, Train Staff, and Update the Plan Regularly\n## Identifying and Digging Deeper: Detecting, Investigating, and Analyzing Incidents\n## Establish a Clear Process for Identifying and Reporting Cyber Alerts\n## Investigate and Declare a Cyber Incident\n# Engaging Help: Activating the Response Team and Engaging Resources\n## Activate the Cyber Incident Response Team\n## Engage Expert Response Resources\n## Take Action: Containment and Eradication\n## Incident Recovery and Post Incident Activity\n## Appendix A: Resource Matrix and Additional Resources","[{\"question\":\"What does the MPM CIRP focus on for medical product manufacturers?\",\"answer\":\"It focuses on responding to manufacturing cyber incidents affecting medical products such as devices, drugs, and biologics. Guidance covers the full response lifecycle from preparation through recovery and post-incident activity.\"},{\"question\":\"Which phases of cyber incident response are included in the playbook?\",\"answer\":\"The playbook addresses preparedness; detection, investigation, and analysis; containment; eradication; and recovery and post-incident activity. Each phase includes practical recommendations and processes.\"},{\"question\":\"How does the playbook handle communication and legal obligations during incidents?\",\"answer\":\"It provides procedures for strategic communication and for legal response, including reporting incident information as required by laws, regulations, and contracts. It also outlines federal cyber incident reporting obligations and related insurance contract requirements when applicable.\"}]","Medical Product Manufacturer Cyber Incident Response Playbook (MPM CIRP) - November 2024 | PDF",1790818015,86]