Vendor security reviews · Digital health & life sciences
Vendor Security Review & Questionnaire Support for Medical Device Makers
Vendor security review for a device maker runs in two directions: answering the MDS2 form and network-connection questionnaire a hospital's biomedical engineering department sends you, and setting security expectations for the component suppliers and contract manufacturers upstream of your own device. Work usually starts when a hospital deal stalls on an unanswered questionnaire, or when a supplier's component raises a question nobody has asked in writing before. We build the answer library and the supplier terms so both directions are handled consistently.
Reviewed by the Privacy Horizon team · Last reviewed
What you're protecting
What has to be reviewed on each side of your supply chain
A device maker sits in the middle of a chain, reviewed by hospitals downstream and reviewing suppliers upstream.
Hospital MDS2 and network-connection responses
The security disclosure and network documentation a biomedical engineering department requires before allowing your device onto its clinical network.
Component and SOM supplier terms
Security requirements placed on the vendors of chips, system-on-module boards and subassemblies that end up inside your finished device.
Contract manufacturer security posture
Review of the facilities and processes building your hardware, since a compromise there can affect the integrity of every unit produced.
RPM cloud sub-processors
The cloud hosting, analytics and support tooling vendors that touch telemetry and complaint data behind your product.
Distributor and field-service access
Third parties who access devices or accounts on your behalf, whose own security practices become part of your exposure the moment you grant them access.
Regulatory map
Why this looks different from a typical SaaS vendor questionnaire
Hospital procurement for a connected device runs through a different process than a standard enterprise security review.
MDS2-driven biomedical engineering review
Hospitals assess connected devices through an MDS2 security disclosure and a network-connection review process run by biomedical engineering, not a generic SaaS security questionnaire template.
ISO 13485's supplier-control requirement
Certified quality management already requires control over suppliers affecting product conformity, giving a natural anchor for adding security expectations to the same supplier relationships.
Supply-chain content in premarket cybersecurity evidence
Health Canada's guidance expects manufacturers to describe how security was built into the device, which reasonably extends to how supplied components and contract manufacturing were assessed.
What goes wrong
What a structured review prevents
Both directions of this review exist to catch a problem before a customer or a regulator does.
A hidden-functionality finding in a purchased component
Undocumented capability discovered inside a supplied chip or module, similar to findings that have surfaced in other device categories, becomes an existential procurement event once it reaches a hospital's attention.
A distributor or field-service path into hospital networks
Third-party access granted without security review can become the intrusion path a biomedical engineering department is specifically trying to screen out with its MDS2 process.
Inconsistent answers across sales reps
Without a maintained answer library, different regional teams give hospitals different, sometimes contradictory, answers to the same MDS2 questions, undermining trust with every customer who compares notes.
Our vendor security reviews for medical device makers
What our vendor security review covers for a device maker
A reusable answer set for hospitals, and a structured review process for the suppliers behind your product.
MDS2 and network-connection answer library
A current, accurate, reusable set of responses to the security disclosure and network documentation hospitals request, kept consistent across your sales team.
Component and SOM supplier security review
Assessment of your existing suppliers' security practices, and the terms to add to new supplier agreements going forward.
Contract manufacturer review
Evaluation of the security practices at facilities producing your hardware, particularly around access control and change management on the production line.
Cloud sub-processor review
Assessment of the vendors behind your RPM cloud back-end, so a sub-processor's own weakness does not become your unmanaged exposure.
Ongoing reassessment cadence
A schedule for revisiting supplier and hospital-facing answers, triggered by a new component, a new hospital contract, or an advisory affecting a comparable device.
How the engagement runs
How we build the review process with you
We inventory both directions of your supply chain before drafting anything, since the two review types need different structures.
Step 1
Inventory suppliers, components and cloud vendors
We map every component supplier, contract manufacturer and cloud sub-processor currently in your product, and every hospital-facing questionnaire type you have received.
Step 2
Build the reusable MDS2 and network-connection answer set
A maintained, accurate answer library your sales and support teams can pull from consistently, reducing questionnaire turnaround time.
Step 3
Set supplier security contract terms
Security expectations are drafted for inclusion in new and renewed supplier and contract-manufacturer agreements.
Step 4
Establish an ongoing reassessment schedule
Suppliers and answer sets are revisited on a defined cadence, and immediately after any relevant advisory or component change.
What it costs
What determines vendor review cost for a device maker
Cost depends on the number of component suppliers, contract manufacturers and cloud sub-processors in your product, and how many distinct hospital MDS2 formats and network-connection agreements your sales team currently handles. A company selling into several health regions at once typically fields more questionnaire variants than one focused on a single provincial market.
A device maker with a single hardware platform and a small supplier list costs less to review than one running multiple product lines with different contract manufacturers. We scope pricing after mapping your current supplier and hospital-questionnaire volume, and can prioritize whichever hospital deal is currently waiting on an answer.
Medical Device Makers: Vendor security reviews questions, answered
Build a maintained answer library once, accurate to your current architecture, and keep it current as your product changes, rather than rewriting responses from scratch for each hospital. Assign a single owner to keep the library consistent across sales and support teams, so different regions are not sending contradictory answers.
No. An MDS2 form is specific to medical devices and covers hardware, software and network characteristics relevant to hospital biomedical engineering, while SOC 2 and ISO 27001 questionnaires focus on organizational information-security controls. A device maker with cloud infrastructure may need to answer both types for the same hospital deal.
The review structure differs. Cloud vendors are assessed on data handling, access control and their own sub-processor chain, while hardware suppliers are assessed on component provenance and firmware integrity. Both feed into the same overall supplier risk picture, but the questions asked are not identical.
Review the agreement against what your device and support processes can actually deliver before signing, particularly around remote-maintenance access terms and incident notification timelines. Signing commitments engineering cannot meet creates risk that surfaces later, typically during an actual support incident.
More for medical device makers
Other services for this niche
About this service
What's Protecting Your Business from the Next Threat?
Don't wait for a breach to expose your vulnerabilities. Let Privacy Horizon secure your data, ensure compliance, and build lasting trust.