MDCG 2019-16 Guidelines: Case Study-Based Assessment and Path Forward

Christos Androutsos; Steve Taylor; Karin Bernsmed; Andrea Neverdal Skytterholm; Gregory Epiphaniou; Nabil Moukafih; Theodoros N. Arvanitis; Sotiris Messinis; Nikos Papadakis; Marco Fruscione; Andrés Castillo; Dusko Milojevic; Dimitrios S. Karas; Nikolaos Fotos; Max Ostermann; Oscar Freyer; Stephen Gilbert; Vasilis Pezoulas; Lambros Athanasiou; George Gkois; Dimitrios I. Fotiadis

doi:10.1007/978-3-031-94855-8_22

MDCG 2019-16 Guidelines: Case Study-Based Assessment and Path Forward

Christos Androutsos
, Steve Taylor
, Karin Bernsmed
, Andrea Neverdal Skytterholm
, Gregory Epiphaniou
, Nabil Moukafih
, Theodoros N. Arvanitis
, Sotiris Messinis
, Nikos Papadakis
, Marco Fruscione
, Andrés Castillo
, Dusko Milojevic
, Dimitrios S. Karas
, Nikolaos Fotos
, Max Ostermann
, Oscar Freyer
, Stephen Gilbert
, Vasilis Pezoulas
, Lambros Athanasiou
, George Gkois

Dimitrios I. Fotiadis^*

^*Corresponding author for this work

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

2 Scopus citations

Abstract

The Medical Device Coordination Group (MDCG) 2019-16 guidelines provide a structured framework for cybersecurity in Connected Medical Devices (CMDs) throughout their lifecycle, offering guidance on how to fulfil all the relevant essential requirements outlined in Annex I of both the Medical Device Regulation (MDR) and the In Vitro Diagnostic Medical Devices Regulation (IVDR). This paper evaluates the practical applicability and limitations of these guidelines based on feedback from six Horizon Europe (HEU) projects. Each project employed case studies reflecting diverse CMD environments and operational contexts to assess the guidelines’ relevance and effectiveness in real-words scenarios. The paper identifies gaps in the practical application of the guidelines and explores their impact on different stages of the CMD lifecycle, from design and development to deployment and post-market activities. Based on these findings, the paper proposes targeted recommendations aimed at enhancing the usability and effectiveness of the MDCG 2019-16 guidelines. The insights contribute to the ongoing evolution of cybersecurity practices in medical technology, ensuring the guidelines are better aligned with the needs of CMD stakeholders, including manufacturers, integrators, and operators, while supporting the development of more resilient and secure medical devices.

Original language	English
Title of host publication	Cybersecurity - 9th European Interdisciplinary Cybersecurity Conference, EICC 2025, Proceedings
Editors	Isabel Praça, Simona Bernardi, Pedro R.M. Inácio
Publisher	Springer Science and Business Media Deutschland GmbH
Pages	338-355
Number of pages	18
ISBN (Print)	9783031948541
DOIs	https://doi.org/10.1007/978-3-031-94855-8_22
State	Published - 2025
Externally published	Yes
Event	9th European Interdisciplinary Cybersecurity Conference, EICC 2025 - Rennes, France Duration: 18 Jun 2025 → 19 Jun 2025

Publication series

Name	Communications in Computer and Information Science
Volume	2500 CCIS
ISSN (Print)	1865-0929
ISSN (Electronic)	1865-0937

Conference

Conference	9th European Interdisciplinary Cybersecurity Conference, EICC 2025
Country/Territory	France
City	Rennes
Period	18/06/25 → 19/06/25

Bibliographical note

Publisher Copyright:
© The Author(s), under exclusive license to Springer Nature Switzerland AG 2025.

Keywords

Cybersecurity
Medical Device Coordination Group
Medical Devices

ASJC Scopus subject areas

General Computer Science
General Mathematics

Access to Document

10.1007/978-3-031-94855-8_22

Cite this

Androutsos, C., Taylor, S., Bernsmed, K., Skytterholm, A. N., Epiphaniou, G., Moukafih, N., Arvanitis, T. N., Messinis, S., Papadakis, N., Fruscione, M., Castillo, A., Milojevic, D., Karas, D. S., Fotos, N., Ostermann, M., Freyer, O., Gilbert, S., Pezoulas, V., Athanasiou, L., ... Fotiadis, D. I. (2025). MDCG 2019-16 Guidelines: Case Study-Based Assessment and Path Forward. In I. Praça, S. Bernardi, & P. R. M. Inácio (Eds.), Cybersecurity - 9th European Interdisciplinary Cybersecurity Conference, EICC 2025, Proceedings (pp. 338-355). (Communications in Computer and Information Science; Vol. 2500 CCIS). Springer Science and Business Media Deutschland GmbH. https://doi.org/10.1007/978-3-031-94855-8_22

Androutsos, Christos ; Taylor, Steve ; Bernsmed, Karin et al. / MDCG 2019-16 Guidelines : Case Study-Based Assessment and Path Forward. Cybersecurity - 9th European Interdisciplinary Cybersecurity Conference, EICC 2025, Proceedings. editor / Isabel Praça ; Simona Bernardi ; Pedro R.M. Inácio. Springer Science and Business Media Deutschland GmbH, 2025. pp. 338-355 (Communications in Computer and Information Science).

@inproceedings{3a7a3b1cb2a5450293a9488af3fc8a92,

title = "MDCG 2019-16 Guidelines: Case Study-Based Assessment and Path Forward",

abstract = "The Medical Device Coordination Group (MDCG) 2019-16 guidelines provide a structured framework for cybersecurity in Connected Medical Devices (CMDs) throughout their lifecycle, offering guidance on how to fulfil all the relevant essential requirements outlined in Annex I of both the Medical Device Regulation (MDR) and the In Vitro Diagnostic Medical Devices Regulation (IVDR). This paper evaluates the practical applicability and limitations of these guidelines based on feedback from six Horizon Europe (HEU) projects. Each project employed case studies reflecting diverse CMD environments and operational contexts to assess the guidelines{\textquoteright} relevance and effectiveness in real-words scenarios. The paper identifies gaps in the practical application of the guidelines and explores their impact on different stages of the CMD lifecycle, from design and development to deployment and post-market activities. Based on these findings, the paper proposes targeted recommendations aimed at enhancing the usability and effectiveness of the MDCG 2019-16 guidelines. The insights contribute to the ongoing evolution of cybersecurity practices in medical technology, ensuring the guidelines are better aligned with the needs of CMD stakeholders, including manufacturers, integrators, and operators, while supporting the development of more resilient and secure medical devices.",

keywords = "Cybersecurity, Medical Device Coordination Group, Medical Devices",

author = "Christos Androutsos and Steve Taylor and Karin Bernsmed and Skytterholm, \{Andrea Neverdal\} and Gregory Epiphaniou and Nabil Moukafih and Arvanitis, \{Theodoros N.\} and Sotiris Messinis and Nikos Papadakis and Marco Fruscione and Andr{\'e}s Castillo and Dusko Milojevic and Karas, \{Dimitrios S.\} and Nikolaos Fotos and Max Ostermann and Oscar Freyer and Stephen Gilbert and Vasilis Pezoulas and Lambros Athanasiou and George Gkois and Fotiadis, \{Dimitrios I.\}",

note = "Publisher Copyright: {\textcopyright} The Author(s), under exclusive license to Springer Nature Switzerland AG 2025.; 9th European Interdisciplinary Cybersecurity Conference, EICC 2025 ; Conference date: 18-06-2025 Through 19-06-2025",

year = "2025",

doi = "10.1007/978-3-031-94855-8\_22",

language = "English",

isbn = "9783031948541",

series = "Communications in Computer and Information Science",

publisher = "Springer Science and Business Media Deutschland GmbH",

pages = "338--355",

editor = "Isabel Pra{\c c}a and Simona Bernardi and In{\'a}cio, \{Pedro R.M.\}",

booktitle = "Cybersecurity - 9th European Interdisciplinary Cybersecurity Conference, EICC 2025, Proceedings",

address = "Germany",

}

Androutsos, C, Taylor, S, Bernsmed, K, Skytterholm, AN, Epiphaniou, G, Moukafih, N, Arvanitis, TN, Messinis, S, Papadakis, N, Fruscione, M, Castillo, A, Milojevic, D, Karas, DS, Fotos, N, Ostermann, M, Freyer, O, Gilbert, S, Pezoulas, V, Athanasiou, L, Gkois, G & Fotiadis, DI 2025, MDCG 2019-16 Guidelines: Case Study-Based Assessment and Path Forward. in I Praça, S Bernardi & PRM Inácio (eds), Cybersecurity - 9th European Interdisciplinary Cybersecurity Conference, EICC 2025, Proceedings. Communications in Computer and Information Science, vol. 2500 CCIS, Springer Science and Business Media Deutschland GmbH, pp. 338-355, 9th European Interdisciplinary Cybersecurity Conference, EICC 2025, Rennes, France, 18/06/25. https://doi.org/10.1007/978-3-031-94855-8_22

MDCG 2019-16 Guidelines: Case Study-Based Assessment and Path Forward. / Androutsos, Christos; Taylor, Steve; Bernsmed, Karin et al.
Cybersecurity - 9th European Interdisciplinary Cybersecurity Conference, EICC 2025, Proceedings. ed. / Isabel Praça; Simona Bernardi; Pedro R.M. Inácio. Springer Science and Business Media Deutschland GmbH, 2025. p. 338-355 (Communications in Computer and Information Science; Vol. 2500 CCIS).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - MDCG 2019-16 Guidelines

T2 - 9th European Interdisciplinary Cybersecurity Conference, EICC 2025

AU - Androutsos, Christos

AU - Taylor, Steve

AU - Bernsmed, Karin

AU - Skytterholm, Andrea Neverdal

AU - Epiphaniou, Gregory

AU - Moukafih, Nabil

AU - Arvanitis, Theodoros N.

AU - Messinis, Sotiris

AU - Papadakis, Nikos

AU - Fruscione, Marco

AU - Castillo, Andrés

AU - Milojevic, Dusko

AU - Karas, Dimitrios S.

AU - Fotos, Nikolaos

AU - Ostermann, Max

AU - Freyer, Oscar

AU - Gilbert, Stephen

AU - Pezoulas, Vasilis

AU - Athanasiou, Lambros

AU - Gkois, George

AU - Fotiadis, Dimitrios I.

PY - 2025

Y1 - 2025

N2 - The Medical Device Coordination Group (MDCG) 2019-16 guidelines provide a structured framework for cybersecurity in Connected Medical Devices (CMDs) throughout their lifecycle, offering guidance on how to fulfil all the relevant essential requirements outlined in Annex I of both the Medical Device Regulation (MDR) and the In Vitro Diagnostic Medical Devices Regulation (IVDR). This paper evaluates the practical applicability and limitations of these guidelines based on feedback from six Horizon Europe (HEU) projects. Each project employed case studies reflecting diverse CMD environments and operational contexts to assess the guidelines’ relevance and effectiveness in real-words scenarios. The paper identifies gaps in the practical application of the guidelines and explores their impact on different stages of the CMD lifecycle, from design and development to deployment and post-market activities. Based on these findings, the paper proposes targeted recommendations aimed at enhancing the usability and effectiveness of the MDCG 2019-16 guidelines. The insights contribute to the ongoing evolution of cybersecurity practices in medical technology, ensuring the guidelines are better aligned with the needs of CMD stakeholders, including manufacturers, integrators, and operators, while supporting the development of more resilient and secure medical devices.

AB - The Medical Device Coordination Group (MDCG) 2019-16 guidelines provide a structured framework for cybersecurity in Connected Medical Devices (CMDs) throughout their lifecycle, offering guidance on how to fulfil all the relevant essential requirements outlined in Annex I of both the Medical Device Regulation (MDR) and the In Vitro Diagnostic Medical Devices Regulation (IVDR). This paper evaluates the practical applicability and limitations of these guidelines based on feedback from six Horizon Europe (HEU) projects. Each project employed case studies reflecting diverse CMD environments and operational contexts to assess the guidelines’ relevance and effectiveness in real-words scenarios. The paper identifies gaps in the practical application of the guidelines and explores their impact on different stages of the CMD lifecycle, from design and development to deployment and post-market activities. Based on these findings, the paper proposes targeted recommendations aimed at enhancing the usability and effectiveness of the MDCG 2019-16 guidelines. The insights contribute to the ongoing evolution of cybersecurity practices in medical technology, ensuring the guidelines are better aligned with the needs of CMD stakeholders, including manufacturers, integrators, and operators, while supporting the development of more resilient and secure medical devices.

KW - Cybersecurity

KW - Medical Device Coordination Group

KW - Medical Devices

UR - https://www.scopus.com/pages/publications/105009241992

U2 - 10.1007/978-3-031-94855-8_22

DO - 10.1007/978-3-031-94855-8_22

M3 - Conference contribution

AN - SCOPUS:105009241992

SN - 9783031948541

T3 - Communications in Computer and Information Science

SP - 338

EP - 355

BT - Cybersecurity - 9th European Interdisciplinary Cybersecurity Conference, EICC 2025, Proceedings

A2 - Praça, Isabel

A2 - Bernardi, Simona

A2 - Inácio, Pedro R.M.

PB - Springer Science and Business Media Deutschland GmbH

Y2 - 18 June 2025 through 19 June 2025

ER -

Androutsos C, Taylor S, Bernsmed K, Skytterholm AN, Epiphaniou G, Moukafih N et al. MDCG 2019-16 Guidelines: Case Study-Based Assessment and Path Forward. In Praça I, Bernardi S, Inácio PRM, editors, Cybersecurity - 9th European Interdisciplinary Cybersecurity Conference, EICC 2025, Proceedings. Springer Science and Business Media Deutschland GmbH. 2025. p. 338-355. (Communications in Computer and Information Science). doi: 10.1007/978-3-031-94855-8_22

MDCG 2019-16 Guidelines: Case Study-Based Assessment and Path Forward

Abstract

Publication series

Conference

Bibliographical note

Keywords

ASJC Scopus subject areas

Access to Document

Fingerprint

Cite this