  Connected Medical Devices (CMDs) have a large impact on patients as they
allow them to lead a more normal life. Any malfunction could not only remove
the health benefits the CMDs provide, they could also cause further harm to the
patient. Due to this, there are many safety regulations which must be adhered
to prior to a CMD entering the market. However, while many detailed safety
regulations exist, there are a fundamental lack of cybersecurity frameworks
applicable to CMDs. While there are recent regulations which aim to enforce
cybersecurity practices, they are vague and do not contain the concrete steps
necessary to implement cybersecurity. This paper aims to fill that gap by
describing a framework, CyMed, to be used by vendors and ens-users, which
contains concrete measures to improve the resilience of CMDs against cyber
attack. The CyMed framework is subsequently evaluated based on practical tests
as well as expert interviews.
