The cybersecurity maturity among medical device manufacturers varies, with the industry as a whole showing a low level of maturity. According to the 'Medical Device Cybersecurity Maturity Industry Benchmark Report,' released in October 2022, average Capability Maturity Model Integration (CMMI) scores are as follows: Organizational structure: 1.68, Risk management: 1.47, Design control: 1.42, and Complaint handling: 1.47.

MDMs are encouraged to enhance their cybersecurity practices by focusing on areas where they scored low, such as briefing organizational leadership on product security policies, assessing third parties for security, establishing end-of-life support dates for third-party components, and remediating medium-to-critical severity vulnerabilities within a recommended 60-day window after discovery.

MDMs face challenges such as a lack of formalized security plans throughout the product lifecycle, with 71% not having these plans in place. Additionally, while 70% report a maturity level of Managed or above regarding security testing during the Design Control phase, a similar percentage indicates they are at an Initiated level or below for critical cybersecurity processes like hardening standards, system patching, and vulnerability scanning.