Cyber Attachment 3 MDE PMO Cyber MDERA v7.0

DEFENSE HEALTH AGENCY (DHA) Medical Devices
and Equipment (MDE) PMO Cybersecurity
693 Neiman Street
Ft. Detrick, Maryland 21702

Medical Device and Equipment Risk Assessment (MDERA)

Version 7.0

27 May 2026

The MDERA is utilized by the Centrally and Non-Centrally Managed MDE Cybersecurity RMF Teams

To ascertain security compliance that is in agreement with United States Federal Government (USFG), Department of War (DoW), and Defense Health Agency (DHA) policies and directives, the vendor is required to complete the following Medical Device Equipment Readiness Assessment (MDERA) as part of the Request for Offer (RFO)/Risk Management Framework (RMF) Change Control Board (CCB) review process. All Medical Systems/Devices are required to meet DoW cybersecurity and National Institute of Standards and Technology (NIST) standards, regardless of network connection type. The information provided below will be used as a pre-procurement selection tool used to support all stakeholders working to achieve a Risk Management Framework (RMF) Authorization. Failure to disclose all required information, or misrepresentation of the proposed system’s capabilities, will result in the system being ineligible for purchase, or result in a breach of contract and cancellation of contract if discovered after award. The information provided below which includes data processing capabilities, current security posture, and level of compliance with the cybersecurity principles of Confidentiality, Integrity, and Availability will be used to identify the technical characteristics of the Medical System/Device and determine the level of effort and potential actions required prior to and during an RMF Assessment process, from a cybersecurity standpoint.

MDERA VER 7.0

Date
27-May-26

MDERA VER 7.0

Revision History

Section/Item
Edited 1.11,2.0,2.7,3.3, added 3.12,3.14,4.0

Comments
Org update-to v7.0

Author
MDE PMO Cyber

READ BEFORE PROCEEDING:

THIS SECTION OF THE MEDICAL DEVICE AND EQUIPMENT RISK ASSESSMENT (MDERA) QUESTIONNAIRE IS TO BE COMPLETED BY THE COMMERCIAL VENDOR IN ITS ENTIRETY AS PART OF THE MEDICAL DEVICE & EQUIPMENT (MDE) REQUEST FOR INFORMATION (RFI) PROCESS. THEREFORE, ALL INFORMATION FIELDS MUST BE ADDRESSED. REFERENCES TO EXTERNAL DOCUMENTS OR PRODUCT LITERATURE ARE NOT ACCEPTABLE.
ONCE COMPLETED, SUBMIT THE MDERA TO THE DESIGNATED POINT OF CONTACT (POC). IF THE POC IS UNKNOWN, SUBMIT THE COMPLETED MDERA TO THE CYBERLOG ORG BOX: [email protected] or ICS ORG BOX: