To begin an assessment, a medical device manufacturer (MDM) must have the medical device in their Assessment Inventory to execute an Assessment against. See "Manage Organization for Medical Device Manufacturer (MDM)" article for guidance on the option to set up up the organization to add devices to the manufacturer's inventory and create assessments.
1. Log in to MDRAP.
2. Click on Go to Assessments/View Existing Assessments icon or click on Assessments tab on the navigation bar across the top of the page.
3. Click the RED PLUS SIGN at the top right, to Create a New Assessment.
4. After selecting the medical device of interest from the inventory list a pop-up box to Create Assessment is displayed. Select the Risk Assessment Questionnaire form to use (i.e., either MDM Questionnaire or MDS2 Manufacturer Disclosure Statement). Click on the orange ADD button to Create the Assessment form for the device selected.
4a. Difference between MDS2 and MDM assessments: Manufacturers can select to perform either the MDM or the MDS2 Assessment in MDRAP. The MDS2 assessment contains only the MDS2 questions. The MDM assessment also contains all the MDS2 questions and additional questions describing expected network attributes. It also contains Level of Effort for remediation and Impact of exploit quests for each of the 10 control categories. The MDM questionnaire is the same question set that the healthcare delivery organizations complete and provides scoring. Scored assessment can be compared at the control level.
Both the MDS2 and MDM assessment are contributed to the community and are available based on the manufacturer's organization sharing settings. They also create an MDS2 document which is stored in the MDS2 library. All assessments provide a printable report that includes all questions, answers, and comments. The MDS2 assessment was developed some manufacturers not having developed a mechanism to create and share MDS2s with their customer base.
5. A new window will display the MDM Assessment Questionnaire with all Control Categories and interactive hyperlinks to navigate all of the risk assessment questions that are included in the questionnaire. A partial list of the Control Categories for an MDM Assessment on the Philips Medical Systems Pump is shown in the screenshot below.
6. A new Assessment has been created for the device selected from the MDM's inventory listing and will be included in the Assessments list for the organization.