MDERA.pdf

This is a Medical Device and Equipment Risk Assessment (MDERA) questionnaire template, Version 6.4.1, issued by the Defense Health Agency (DHA) Medical Cybersecurity office located in Ft. Detrick, Maryland.

The MDERA is a security compliance assessment tool that vendors must complete as part of the Request for Offer (RFO) and Risk Management Framework (RMF) Change Control Board review process for medical device procurements. The questionnaire ensures medical systems and devices meet Department of Defense cybersecurity and National Institute of Standards and Technology (NIST) standards regardless of network connection type. The assessment covers three main sections: System Identification (including device specifications, regulatory information, operational modes, cloud offerings, and implementation methods), Technical Information (detailing hardware/firmware components, operating systems, applications, user accounts, system architecture, endpoint protection, vulnerability scanning, patching policies, remote access, and wireless capabilities), and Data Processing Capabilities (addressing electronic protected health information handling, encryption capabilities, and data storage methods). Failure to disclose required information or misrepresentation of system capabilities will result in the system being ineligible for purchase or contract breach and cancellation if discovered after award. The document includes example entries and revision history dating back to 2019, with the most recent updates in February 2024 adding USB Flash Drive requirements.