Cybersecurity is one of the most critical issues impacting the healthcare industry. At BD, we maintain an unwavering commitment to security by design, in use and through partnership. We strive to ensure our products, systems and customer environments maintain high security standards so our customers can focus on what matters most: caring for patients.
While we maintain robust security protocols, we also recognize that new security threats emerge daily, from attempts to compromise healthcare data to coordinated efforts to disrupt clinical workflows or manufacturing. We recognize that our customers cannot protect what they don’t know. That’s why we believe transparency and collaboration are essential. As we build a strong community of practice, working closely with our customers, industry regulators and security researchers, we’re improving cybersecurity and resilience across the industry.
— Rob Suárez, Vice President and Chief Information Security Officer
BD products and systems are designed to be secure and are developed using industry-leading cybersecurity standards, including those from ISO and NIST.
BD utilizes a framework to incorporate cybersecurity into our processes for product design, manufacturing, customer support and enterprise systems. Our framework has been aligned to various industry work products including the Healthcare & Public Health Sector Coordinating Councils (HSCC) Medical Device and Health IT Joint Security Plan, the National Institute of Standards and Technology (NIST) Cybersecurity Framework, the International Organization for Standardization (ISO) 27001 standards, Underwriters Laboratories (UL) 2900 Standard for Software Cybersecurity for Network-Connectable Products and the International Society of Automation (ISA) 62443.
BD became the first medical technology company authorized as a Common Vulnerability and Exposures (CVE®) Numbering Authority.
The IMDRF published Principles and Practices for Medical Device Cybersecurity.
BD received UL CAP certification for BD Synapsys™ Microbiology Informatics.
The HSCC published the Medical Device and Health IT Joint Security Plan (JSP).
BD CISO Rob Suárez co-chaired the HSCC Med Tech Cybersecurity Risk Management Task Group.
BD made product security templates available via the BD Cybersecurity Trust Center.
BD received UL CAP certification for the BD FACSLyric™ flow cytometer.
BD established a Product Security Partnership program.
The FDA published Postmarket Management of Cybersecurity in Medical Devices.
The FDA published Content of Premarket Submissions for Management of Cybersecurity in Medical Devices.
The Advanced Medical Technology Association advocates globally for the highest ethical standards and patient access to safe, effective and innovative medical technologies.
The Association of Information Security Professionals, based in Singapore, is committed to promoting the development, increase and spread of cybersecurity knowledge.
The Cybersecurity Coalition for Asia Pacific is dedicated to improving the policy landscape for cybersecurity in Asia.
BD is authorized as a Common Vulnerability and Exposures (CVE) Numbering Authority by the CVE Program.
The Domestic Security Alliance Council is a strategic alliance that includes the U.S. Federal Bureau of Investigation (FBI), Department of Homeland Security and private industry networking together.
For maximum reach, BD shares coordinated vulnerability disclosures with the Health Information Sharing and Analysis Center.
BD participates in multiple Healthcare and Public Health Sector Coordinating Council (HSCC) Cybersecurity Working Group Task Groups.
BD participates in the International Medical Device Regulators Forum with the shared goal of harmonizing medical device cybersecurity around the world.
The Medical Device Innovation Consortium works with government and industry stakeholders to advance solutions that promote patient access to innovative medical technologies.
BD participates in the MedTech Europe Cybersecurity Working Group, which brings cybersecurity experts together to engage with European institutions, including the European Union Agency for Cybersecurity (ENISA).
BD participates in the U.S. FBI InfraGard, a partnership between the FBI and the private sector for the purpose of protecting U.S. Critical Infrastructure.
BD recognizes the value to our customers of independent cybersecurity attestation. Each year a range of third-party audits are performed on BD products and internal cybersecurity controls. To demonstrate our commitment to product security and the protection of customer data, BD makes these industry-recognized certifications and attestation reports available to customers.
BD maintains a SOC2+ program for multiple BD products that collect and process patient health information in accordance with the HIPAA security rule. These annual audits address the Trust Principles for Security and, for our cloud-based products, Availability. These reports are prepared by an independent third party and provide assurance regarding the operational effectiveness of BD internal controls and the security of BD products.
UL CAP, which stands for Underwriters Laboratories Cybersecurity Assurance Program, is an independently audited certification that demonstrates the cybersecurity of medical device products through a rigorous program of analysis. UL CAP cybersecurity testing is extensive and challenges BD products against known cybersecurity vulnerabilities, malware, malformed input (fuzz testing), structured penetration, static source code analysis, static binary and bytecode analysis, and verification of security controls (access control, user authentication and authorization, remote communication, cryptography and software updates).
BD maintains Product Security White Papers for its software-enabled products. The purpose of these documents is to provide details on how BD security and privacy practices have been applied and what our customers should know about maintaining security throughout the entire product life cycle. Each white paper includes a Manufacturer Disclosure Statement for Medical Device Security (MDS2 attestation).
SOC2+ reports and Product Security White Papers are restricted to existing BD customers and can be requested below. UL CAP certificates display the scope (product and version), validity period and certifying UL Manager and can be downloaded below. Prospective customers that wish to obtain copies of SOC2+ reports or Product Security White Papers can request these from their sales representative following approval of a Confidential Disclosure Agreement (CDA). Select the documents you would like to access and use the icons at the bottom of the page to trigger the download or request.
| Product | Request SOC2 report | Download UL CAP certificate | Request BD product security white paper |
|---|---|---|---|
| BD Knowledge Portal for BD Pyxis™ Supply Technologies | |||
| BD Pyxis™ SupplyStation system |
| Product | Request SOC2 report | Download UL CAP certificate | Request BD product security white paper |
|---|---|---|---|
| BD Cato™ | |||
| BD Knowledge Portal for BD Pyxis™ Medication Technologies | |||
| BD Pyxis™ Anesthesia Station ES | |||
| BD Pyxis™ Anesthesia Station | |||
| BD Pyxis™ CIISafe | |||
| BD Pyxis™ Connect | |||
| BD Pyxis™ DuoStation system | |||
| BD Pyxis™ EcoStation system | |||
| BD Pyxis™ Enterprise Server | |||
| BD Pyxis™ Inventory Connect | |||
| BD Pyxis™ IV Prep | |||
| BD Pyxis™ Logistics system | |||
| BD Pyxis™ MedStation | |||
| BD Pyxis™ ParAssist | |||
| BD Pyxis™ PARx system | |||
| BD Pyxis™ PharmoPack System | |||
| BD Pyxis™ Remote Manager Temp Monitor | |||
| BD Pyxis™ Tissue and Implant System |
| Product | Request SOC2 report | Download UL CAP certificate | Request BD product security white paper |
|---|---|---|---|
| BD Alaris™ 8015 System | |||
| BD Alaris™ CQI Reporter | |||
| BD Alaris™ Gateway Workstation | |||
| BD Alaris™ neXus CC Syringe Pump | |||
| BD Alaris™ neXus Editor | |||
| BD Alaris™ neXus GP Volumetric Pump | |||
| BD Alaris™ neXus PK Syringe Pump | |||
| BD Alaris™ Technical Utility Software | |||
| BD Alaris™ Communication Engine | |||
| BD BodyComm™ Software | |||
| BD BodyGuard™ Infusion Pump | |||
| BD BodyGuard™ Duo Pump | |||
| BD BodyGuard™ Epidural Pump | |||
| BD BodyGuard™ Pain Manager | |||
| BD BodyGuard™ T Syringe Pump |
| Product | Request SOC2 report | Download UL CAP certificate | Request BD product security white paper |
|---|---|---|---|
| BD HealthSight™ Benchmarks | |||
| BD HealthSight™ Clinical Advisor | |||
| BD HealthSight™ Data Manager | |||
| BD HealthSight™ Diversion Management | |||
| BD HealthSight™ Infection Advisor | |||
| BD HealthSight™ Inventory Optimization | |||
| BD HealthSight™ Medication Safety Analytics |
| Product | Request SOC2 report | Download UL CAP certificate | Request BD product security white paper |
|---|---|---|---|
| BD Care Coordination Engine (CCE) | |||
| BD Remote Support Solution (RSS) / BD Remote Assist / BD Assurity Linc™ |
| Product | Request SOC2 report | Download UL CAP certificate | Request BD product security white paper |
|---|---|---|---|
| BD BACTEC™ FX Instrument | |||
| BD BACTEC™ FX40 Instrument | |||
| BD BACTEC™ MGIT™ 320 Instrument | |||
| BD BACTEC™ MGIT™ 960 Instrument | |||
| BD MAX™ | |||
| BD Phoenix™ AP | |||
| BD Phoenix™ M50 | |||
| BD Veritor™ Plus |
| Product | Request SOC2 report | Download UL CAP certificate | Request BD product security white paper |
|---|---|---|---|
| BD EpiCenter™ | |||
| BD Synapsys™ |
|
| Product | Request SOC2 report | Download UL CAP certificate | Request BD product security white paper |
|---|---|---|---|
| BD COR™ System | |||
| BD DataLink | |||
| BD FocalPoint™ GS imaging system | |||
| BD Totalys™ Multiprocessor | |||
| BD Totalys™ SlidePrep | |||
| BD Viper™ LT System |
| Product | Request SOC2 report | Download UL CAP certificate | Request BD product security white paper |
|---|---|---|---|
| BD Kiestra™ InoqulA | |||
| BD Kiestra™ TLA System | |||
| BD Kiestra™ WCA System |
| Product | Request SOC2 report | Download UL CAP certificate | Request BD product security white paper |
|---|---|---|---|
| BD FACSCalibur™ | |||
| BD FACSCanto™ 10-color | |||
| BD FACSCanto™ II Clinical | |||
| BD FACSCount™ System | |||
| BD FACSDuet™ | |||
| BD FACSLink™ | |||
| BD FACSLyric™ (IVD) |
|
||
| BD FACSPresto™ | |||
| BD FACS™ Sample Prep Assistant (SPA) III | |||
| BD FACSVia™ | |||
| BD FACS™ Lyse Wash Assistant™ (LWA) | |||
| BD FACS™ Workflow Manager |
| Product | Request SOC2 report | Download UL CAP certificate | Request BD product security white paper |
|---|---|---|---|
| BD Accuri™ C6 Plus | |||
| BD FACSAria™ Fusion | |||
| BD FACSAria™ II | |||
| BD FACSAria™ III | |||
| BD FACSCanto™ 10-color | |||
| BD FACSCanto™ II | |||
| BD FACSCelesta™ | |||
| BD FACSJazz™ | |||
| BD FACSLyric™ (RUO) | |||
| BD FACSMelody™ | |||
| BD FACSVerse™ | |||
| BD FACSymphony™ A1 | |||
| BD FACSymphony™ A3/A5 | |||
| BD FACSymphony™ S6 | |||
| BD FlowJo™ Desktop | |||
| BD Influx™ | |||
| BD™ LSR II | |||
| BD LSRFortessa™ Flow Cytomenter | |||
| BD LSRFortessa™ X-20 Cell Analyzer | |||
| BD Rhapsody™ Single-Cell Analysis System | |||
| BD SeqGeq™ Desktop |
| Product | Request SOC2 report | Download UL CAP certificate | Request BD product security white paper |
|---|---|---|---|
| BD Intelliport™ Medication Management System |
| Product | Request SOC2 report | Download UL CAP certificate | Request BD product security white paper |
|---|---|---|---|
| BD Site~Rite™ 8 Ultrasound Systems | |||
| BD Sherlock 3CG+™ Tip Confirmation System |
| Product | Request SOC2 report | Download UL CAP certificate | Request BD product security white paper |
|---|---|---|---|
| BD Arctic Sun™ Analytics | |||
| BD Arctic Sun™ 5000 Temperature Management System | |||
| BD Arctic Sun™ 6000 Stat Temperature Management System |
| Product | Request SOC2 report | Download UL CAP certificate | Request BD product security white paper |
|---|---|---|---|
| BD™ Diabetes Care App |
| Product | Request SOC2 report | Download UL CAP certificate | Request BD product security white paper |
|---|---|---|---|
| BD Senssica™ Urine Output System |
| Product | Request SOC2 report | Download UL CAP certificate | Request BD product security white paper |
|---|---|---|---|
| BD Pyxis™ MedBank | |||
| BD Pyxis™ RapidRX | |||
| BD Rowa™ Dose | |||
| BD Rowa™ vMAX™ |
BD has established a routine practice of seeking, communicating and addressing cybersecurity issues in a timely fashion. Vulnerability disclosure is an essential component to our approach to transparency by enabling customers to manage risk properly through awareness and guidance.
Process
Learn how a new self-assessment tool is helping the industry establish benchmarks for medical device cybersecurity maturity.
In this podcast episode, BD CISO Rob Suárez shares a collaborative effort to establish industry benchmarks for medical device cybersecurity maturity.
BD CISO Rob Suárez explains how listing a software bill of materials (SBOM) can help improve healthcare cybersecurity.
The second annual BD cybersecurity report details the state of health care cybersecurity, the company's impact on advancing cybersecurity maturity and anticipated trends for 2022.
BD Director of Information Security - Operations, Nastassia Tamari, shares five tips for teaming up with employees to increase cybersecurity readiness across all levels of your organization.
Learn how BD fosters a strong cybersecurity culture by providing opportunities to hear directly from customers and partners, conducting phishing simulations and providing ongoing, tailored cybersecurity training.
BD CISO Rob Suarez shares strategies to help healthcare providers and medical device manufacturers work together to manage medical device cybersecurity amid increasing cyber-risks.
Two industry experts share strategies for reducing ransomware risks, from training staff to recognize threats to boosting cyberattack preparedness.
BD Chief Information Security Officer Rob Suárez previews the company's upcoming cybersecurity panel discussion at HIMSS and discusses transparency and collaboration.
BD Chief Information Security Officer Rob Suárez speaks with Marianne Kolbasuk McGee about medical device security challenges.
For BD, being transparent about potential vulnerabilities is essential because customers can’t protect what they don’t know.
BD becomes the first medical technology company authorized as a Common Vulnerability and Exposures (CVE®) Numbering Authority by the CVE Program, further demonstrating company's leadership in health care cybersecurity.
Healthcare providers can’t protect against vulnerabilities they don’t know about. That’s why we need to take the stigma out of talking about vulnerabilities.
To be secure, medical device manufacturers and healthcare providers will need to go beyond defensive cybersecurity strategies and incorporate cyber resiliency. As more organizations in healthcare embrace these complementary priorities in 2021, we can expect the following cybersecurity trends to emerge.
Through the BD 2020 Cybersecurity Report, the company seeks to address cybersecurity challenges specific to health care and offer guidance about cybersecurity practices for working with medical device manufacturers.
The COVID-19 pandemic continues to place unprecedented demands on the healthcare system. Many hospitals have had to reconfigure their facilities, from expanding remote monitoring and telemedicine to adding dedicated COVID-19 units.
With this growth comes broad and complex challenges, which health care providers, medical device manufacturers and industry regulators must address to secure connected health devices and protect patient safety and privacy.
To improve the resilience of healthcare during a pandemic or any other crisis, we need to adopt Zero Trust principles. In other words, we need to assume nothing and verify everything.
Even as healthcare professionals put their own lives at risk to save patients, cybercriminals are diligently honing their craft. They are exploiting the need for faster, less stringent security vetting processes and conducting their own version of A/B testing to determine which phishing and smishing campaigns are most effective in the current environment.
The BD Synapsys informatics solution is among the first life-science diagnostics informatics platforms to meet all UL CAP cybersecurity standards.
