Infusion Pump Fleet Discovery and Ownership

The scope must cover enterprise IT, clinical safety, and third-party/vendor risk because the exposure sits at their intersection: unsupported devices, shared administration, and an opaque remote gateway. The primary unit of analysis should be the device class/model plus connectivity pattern and clinical function, not each serial number, because the 540 unknowns share common controls and failure modes. Individual devices that are life-critical or externally visible should be tracked separately. Write risk statements in cause-event-impact form, for example: shared local administrator credentials and an unsupported OS could allow unauthorized firmware or configuration changes, causing dose errors or a fleet outage. Ownership should be joint but not diffuse: clinical operations is accountable for patient-safety impact, the CISO is accountable for cyber exposure, and biomedical engineering is custodian. The register should have one named executive owner, with clinical co-signoff. Unknown assets should themselves be logged as an identification risk with indicators such as discovered-versus-inventoried count, percentage vendor-supported, and external exposures. This gives the board a defensible scope without pretending all 1,450 pumps are equally risky.

Use a phased, low-disruption sequence. Week 1: set scope, clinical windows, escalation, and vendor notification; define what counts as discovered. Week 2: passive discovery from network taps, DHCP/ARP tables, NAC, and gateway logs; do not actively scan infusion pumps yet. Week 3: reconcile against the biomedical maintenance system, procurement records, and vendor lists; flag mismatches. Week 4: perform targeted active checks only in approved low-risk windows and authorized external attack-surface checks. Week 5: clinical walkthroughs to confirm location, function, and owner; label devices and map gateway egress. Week 6: populate the risk register and assemble an evidence pack. Do not close the gap merely because a vendor attests to security. Require evidence tying each asset to a MAC/IP/serial and physical location, a named clinical owner, OS/firmware version, support status, administrative model, gateway connectivity, and external exposure confirmation. For the two internet-visible pumps, containment comes first: confirm whether exposure is a management interface or a vendor tunnel, block inbound access, isolate the VLAN, and preserve logs before deciding whether the event is an incident or a configuration finding.

Internet visibility is evidence of exposure, not proof of compromise, so the rating should change based on exploitability and potential impact. The unsupported OS and shared administrator password increase likelihood; infusion pumps increase impact because manipulation or outage can affect patient safety. If the scan found a management interface or default service, rate the finding critical until contained. Immediate actions: verify whether the visibility comes from NAT, port forwarding, a vendor tunnel, or a search-engine artifact; block inbound access; segment the pumps from general IT; capture and review gateway and device logs; check for anomalous configurations or logins; notify the vendor and clinical leadership; and preserve evidence in case this becomes an incident. Do not rely on patching alone because the OS is unsupported. Re-rate after containment, document the residual risk, and add a key risk indicator for externally visible clinical devices. The finding should also prompt a fleet-wide check for the same exposure pattern, since two visible pumps imply a configuration practice rather than isolated bad luck.