Risk, Cybersecurity, and Assurance

Risk and assurance are cross-cutting arguments. They connect to context, requirements, design, and evidence rather than sitting in isolated registers — and in MEMO they claim existing elements through typed relationships instead of copying them into a "safety model."

Safety-risk chain (ISO 14971)

Element	Question
IntendedUse / ReasonablyForeseeableMisuse	What use and foreseeable misuse bound the analysis?
SafetyRelatedCharacteristic	Which device characteristic can affect safety?
HazardCause	What initiating or contributing cause is being analyzed?
Hazard	What is the potential source of harm?
SequenceOfEvents	What reasonably foreseeable sequence or combination of events can create exposure?
HazardousSituation	When is someone exposed to the hazard?
Harm	What injury or damage may result?
Risk	What are the probability of occurrence of harm and its severity before control?
RiskControlMeasure	What measure reduces probability or severity?
ResidualRisk	What risk remains after the control measures?
Benefit	What positive outcome supports a benefit-risk determination?
OverallResidualRiskEvaluation	Is the combined residual risk acceptable?

flowchart LR
    Cause[HazardCause] --> Hazard[Hazard]
    Hazard --> Events[SequenceOfEvents]
    Events --> Situation[HazardousSituation]
    Situation --> Harm[Harm]
    Harm --> Risk[Risk]
    Control[RiskControlMeasure] -->|Mitigates · hazard| Hazard
    Risk --> Control
    Control --> Residual[ResidualRisk]
    Benefit[Benefit] --> Residual
    Control -->|VerifiedBy| Test[VerificationCase]
    Test -->|ProducesEvidence| Evidence[Evidence]

These are dedicated ontology elements. Do not replace SequenceOfEvents with an operational Scenario, or merge HazardCause with the FMEA-specific FailureCause. Risk-management plans, reports, matrices, and benefit-risk documents are artifact views over these elements.

Human factors (IEC 62366-1, FDA HF guidance)

The usability chain runs from the operational world into risk: a UserTask can commit a UseError; a safety-relevant use error must trace to a Hazard; a CriticalTask — one whose failure could cause serious harm — must trace to a UsabilityValidation. MemoScenario[scenarioKind=hazardRelatedUse] selects the scenarios for summative evaluation, and FormativeEvaluation records what design iteration learned. A risk control implemented in the UI (a confirmation dialog, a guarded control, alarm re-annunciation) is linked to the implementing UIElement with ControlImplementedBy — the temperature-alarm example walks the entire chain.

Cybersecurity chain

Use CybersecurityAsset, AttackSurface, Threat, Vulnerability, MemoScenario[scenarioKind=threat] (a threat scenario sharing the workflow/scenario semantics), CyberRisk, CyberMitigation, SecurityRequirement, TrustBoundary, and SecurityClaim. Interfaces that cross a trust boundary say so (CrossesTrustBoundary); see connected-patient-monitor.

Safety and security are connected. Use ImpactsSafety when a cyber condition can affect a safety claim; do not duplicate the same risk independently in two registers.

V&V and evidence

Element	Role
VerificationCase / MemoScenario[scenarioKind=memoVerification]	Shows a design output meets a specified input, and the path exercised
ValidationCase	Shows the device meets user needs and intended use — Validates closes the loop to the operational world
UsabilityValidation	Summative evaluation of critical tasks
Evidence / TestArtifact	Reviewable support for a claim

The V-model is a view over these relationships, not an ontology hierarchy: each definition-side layer is validated or verified by the matching integration-side activity (see The layers). Coverage rules keep the graph honest: safety-critical functions must trace to verification, and critical tasks to usability validation.

Connect evidence to the claim it supports. A file path alone is not a complete assurance argument; record the verification case, acceptance basis, result, and the evidence artifact.

Continue the story

Next, read Elements and Relationships for the practical choices used to write this connected model.