MDS2 data and medical device segmentation: what changes for teams?

TL;DR: MDS2 documentation can be converted into identity-based microsegmentation policies that protect connected medical devices in 4 to 16 weeks, helping healthcare teams reduce lateral movement and preserve clinical workflows, according to Elisity. The governance challenge is not data availability, but operationalising device security intelligence into enforceable policy without creating patient-care disruption.

Editorial analysis by NHI Mgmt Group, based on content published by Elisity: “How to Use MDS2 Data for Network Segmentation and Medical Device Security”.

By the numbers:

• Twenty-two percent of healthcare organizations experienced medical device cyberattacks in the past year, and 75% of those incidents directly affected patient care delivery.
• MDS2 provides standardized cybersecurity documentation covering 23 control categories for medical devices.
• Security teams may need 4-16 weeks to turn MDS2 data into dynamic policies that protect devices without clinical disruption.

Key questions

Q: What fails when medical device segmentation is based on static network trust?

A: Static network trust fails because it treats whole subnets as safe even when individual medical devices have different authentication, encryption, and update capabilities.

Q: Why does MDS2 data matter for healthcare security governance?

A: MDS2 matters because it gives security teams manufacturer-declared detail on authentication, encryption, logging, and network requirements.

Q: What breaks when medical devices cannot be reauthored through normal IAM controls?

A: When medical devices cannot join standard IAM or MFA processes, teams must govern them through network boundaries, device identity, and compensating controls instead of human identity workflows.

Practitioner guidance

• Map MDS2 disclosures to enforceable device policy Convert manufacturer-reported capabilities, limitations, and supported protocols into explicit allowlists for each device class, then tie those policies to actual observed traffic.
• Segment by device role and clinical context Group devices by function, location, and criticality rather than by broad subnet trust, so vulnerable monitors, pumps, and imaging systems do not share the same trust zone.
• Simulate policies before enforcement Test proposed microsegmentation rules against live traffic to confirm that required clinical communications continue to work before any restrictions are turned on.

Bottom line: MDS2 is useful only when organisations convert disclosed device capabilities into enforceable segmentation policy, not when they leave the forms in procurement files.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →