The HSCC Joint Security Plan (JSP2): a total-product-lifecycle guide for medical device makers

Medical device cybersecurity is a shared responsibility split across manufacturers, health IT vendors, and the healthcare delivery organizations that deploy the equipment, with no single party controlling the full lifecycle. HSCC built the JSP so these stakeholder groups — collectively "vendors" for medical device manufacturers (MDMs) and health IT vendors — have one consensus reference instead of each inventing its own lifecycle security process from scratch. HSCC frames the JSP as the industry's practical complement to formal government guidance: it is "security by design" applied across the complete lifecycle, from initial design through development, deployment, field support, and decommissioning, rather than a point-in-time certification exercise.

HSCC describes JSP2 as "important updates and a major refresh of the original JSP published in 2019," built from a cross-industry stakeholder review and lessons drawn from the MDIC Medical Device Cybersecurity Maturity: Industry Benchmarking Report 2022. The headline change is a refreshed Total Product Life Cycle Security Activities framework diagram, reorganizing what were previously framework "components" into explicit, actionable security activities a team can assign and track. JSP2 explicitly addresses Goals #6 and #7 of HSCC's Health Industry Cybersecurity Strategic Plan — goal #6 specifically calling for technology that is "secure-by-design and secure-by-default while reducing the burden and cost on technology users to maintain an effective security posture."

The JSP spans the full product lifecycle: building security controls and processes into design and development, managing product complaints linked to cybersecurity incidents, minimizing and remediating postmarket vulnerabilities, assessing the maturity of a manufacturer's own security program against the framework, and handling end-of-life — including product lifecycle policy, contractual terms (HSCC separately publishes Model Contract Language for Medtech), and disclosure of end-of-life/end-of-support status for the product and its components. For supply-chain-specific controls, JSP2 points to HSCC's companion Health Industry Cybersecurity Supply Chain Risk Management (HIC-SCRiM) guide rather than duplicating that content.

No — JSP2 is a voluntary industry framework, not an FDA-recognized consensus standard or a regulatory requirement, and it is not a substitute for FDA's premarket or postmarket cybersecurity expectations, or for the FDA-recognized AAMI SW96 risk-management standard. The relationship is complementary: FDA guidance and AAMI SW96 define what evidence a submission or a postmarket vulnerability-handling process needs to produce; JSP2 is HSCC's industry-authored operational playbook — shared vocabulary, maturity self-assessment, and lifecycle-stage activities — for how a manufacturer actually organizes the day-to-day work that produces that evidence.

SoftWSP's device and firmware security assessments inventory the components actually shipping in a medical device's firmware and the vulnerabilities affecting them — the kind of concrete, binary-level evidence a JSP2 postmarket-vulnerability or end-of-life activity, and the FDA submission behind it, both need. See device & firmware security services for how that fits into a broader TPLC security program.

This guide is based on the official Medical Device and Health IT Joint Security Plan Version 2.0 PDF (HSCC, March 2024), the JSP2 project page at healthsectorcouncil.org, and the original January 2019 JSP PDF and its release announcement, all read directly for this guide. The JSP is a living HSCC document; check healthsectorcouncil.org/jsp2/ for the current version before citing a specific framework detail.