Guidance offers steps to create, maintain operational technology asset inventory for protection

The Cybersecurity and Infrastructure Security Agency, Environmental Protection Agency, National Security Agency, FBI and international agencies Aug. 13 released guidance for operational technology owners and operators to create and manage an OT asset inventory. Examples of OT in health care include electronic health record systems, medical device hardware and software. The guidance explains ways owners and operators can improve and use their inventory to protect other critical assets. It includes recommendations on OT cybersecurity and risk management, maintenance and reliability, performance monitoring and reporting, and training and awareness. 

“Understanding OT device connectivity to complex hospital networks is critical,” said Scott Gee, AHA deputy national advisor for cybersecurity and risk. “Unmanaged — or worse, unknown — OT devices can add significant vulnerabilities to their system. A perfect example of the risks posed by unmanaged OT devices is the Contec CMS 8000 patient monitors that were discovered sending data to China without authorization. These devices certainly add value in the health care setting, but just like anything else connected to the network, they have to be managed and maintained.” 

For more information on this or other cyber and risk issues, contact Gee at sgee@aha.org. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity.