Score and prioritize your hospital's IoMT risks in 5 minutes. Transparent, tunable, patient-safety focused.

Healthcare organizations face a unique cybersecurity challenge: thousands of connected medical devices — infusion pumps, ventilators, patient monitors, PACS systems — running on legacy operating systems with limited patching options, often sharing network segments with general IT traffic.

Vendors charge six figures for IoMT risk assessment platforms. Academic tools are research prototypes that don't work with real hospital data. This tool fills the gap for the engineer who has a CSV export from their asset inventory and a deadline to present risk findings to leadership.

This is not a replacement for a full security program — it's a practical scoring tool that gives you:

• A defensible, framework-backed risk score for every device
• Prioritized remediation recommendations mapped to NIST and HIPAA
• A professional PDF report you can hand to your CISO

• CSV Upload — Import your existing device inventory in one click
• Manual Entry — Add devices through a guided form with validated dropdowns
• Sample Data — 25 realistic hospital devices across ICU, ER, Radiology, Lab, and Building Systems
• 12 risk-relevant fields per device including network segment, FDA class, PHI handling, and authentication posture

A composite risk score (0–100) calculated from five weighted sub-scores:

Weights are fully tunable via the sidebar — adjust them to match your organization's risk appetite.

Risk levels: Critical (75–100) · High (50–74) · Medium (25–49) · Low (0–24)

• Risk distribution bar chart
• Score histogram with threshold markers
• Risk heatmap: Device Type × Network Segment
• Top 10 riskiest devices
• Radar chart of average sub-scores
• All charts built with Plotly (dark theme, interactive tooltips)

• Per-device risk breakdown with visual sub-score bars
• Radar chart of individual device risk profile
• Actionable recommended controls with:
  • NIST CSF 2.0 citations
  • HIPAA Security Rule references
  • Priority ratings (Critical → Low)
  • Category tags (Network Isolation, Patching, Authentication, etc.)

Professional, downloadable PDF including:

• Executive summary with key metrics
• Methodology documentation
• Full device inventory (sorted by risk)
• Per-device findings with sub-scores and recommendations
• Prioritized remediation plan with timelines
• Framework reference section with URLs

┌──────────────────────────────────────────────────┐
│                  Streamlit UI (app.py)            │
│  ┌─────────┐ ┌──────────┐ ┌────────┐ ┌────────┐ │
│  │Inventory│ │Dashboard │ │ Detail │ │ Report │ │
│  └────┬────┘ └────┬─────┘ └───┬────┘ └───┬────┘ │
│       │           │           │           │      │
│  ┌────▼───────────▼───────────▼───────────▼────┐ │
│  │          scorer.py — Risk Engine            │ │
│  │  Exposure · Vulnerability · Data Sensitivity│ │
│  │  Patient Safety · Authentication            │ │
│  └────────────────┬───────────────────────────┘ │
│                   │                              │
│  ┌────────────────▼────┐  ┌───────────────────┐ │
│  │   controls.py       │  │ report_generator  │ │
│  │   NIST/HIPAA Map    │  │   ReportLab PDF   │ │
│  └─────────────────────┘  └───────────────────┘ │
└──────────────────────────────────────────────────┘

RISK_SCORE = (
    Exposure_Score      × 0.20 +   # Network segment → 5 (Air-Gapped) to 100 (Internet-Facing)
    Vulnerability_Score × 0.20 +   # Patchability + vendor support + OS risk + scan age
    Data_Sensitivity    × 0.20 +   # PHI handling → 10 (None) to 100 (Transmit)
    Patient_Safety      × 0.25 +   # FDA class × device type criticality factor
    Authentication      × 0.15     # Auth method modified by encryption posture
)

• Python 3.11 or higher
• pip

# Clone the repository
git clone https://github.com/itsnmills/iomt-risk-scorer.git
cd iomt-risk-scorer

# Install dependencies
pip install -r requirements.txt

# Run the app
streamlit run app.py

The app will open at http://localhost:8501.

1. Click "📦 Load Sample Data" to load 25 realistic hospital devices
2. Navigate to 📊 Risk Dashboard to see the risk overview
3. Click 🔍 Device Detail to drill into individual devices
4. Go to 📄 Assessment Report to generate a PDF

Prepare a CSV with these columns:

The sample dataset includes devices ranging from:

• Low risk — Air-gapped surgical robot with MFA and full encryption (score ~12)
• Critical risk — Internet-facing building HVAC controller with default credentials and no encryption (score ~82)
• Mixed — Clinical VLAN infusion pumps with vendor-only patching and partial encryption (score ~45-55)

The tool correctly identifies the highest-risk devices and generates specific, actionable remediation steps for each.

iomt-risk-scorer/
├── app.py                  # Streamlit app — multi-page routing and UI
├── scorer.py               # Risk scoring engine — all math lives here
├── controls.py             # Recommended controls mapped to NIST/HIPAA
├── report_generator.py     # PDF report generation with ReportLab
├── sample_devices.csv      # 25 realistic hospital IoMT devices
├── requirements.txt        # Python dependencies
├── README.md               # This file
└── .streamlit/
    └── config.toml         # Dark theme configuration

git clone https://github.com/itsnmills/iomt-risk-scorer.git
cd iomt-risk-scorer
pip install -r requirements.txt

All dependencies are standard, widely-used Python packages:

This tool runs 100% locally on your machine. Here is exactly what it reads, writes, and accesses:

Sample data mode: The tool includes 25 realistic but entirely fictional hospital devices (fake device names, fake serial numbers, fake network configurations) for demonstration purposes. No real hospital or device data is involved.

This is open-source software. You download it, you run it, you own it.

If you're evaluating this tool for your organization: Download it, review the source code, run the demo mode first, and verify for yourself that it meets your security requirements. That's the entire point of open source.

The risk scoring engine and recommended controls are mapped to:

• NIST Cybersecurity Framework (CSF) 2.0
• HIPAA Security Rule (45 CFR §164)
• FDA premarket cybersecurity guidance

Scoring weights are fully tunable via the sidebar to match your organization's risk appetite. When frameworks are updated, the repository will be updated accordingly:

git pull origin main

If you discover a security vulnerability in this tool, please report it responsibly by opening a GitHub issue or contacting the maintainer directly. Do not submit PHI or real patient data in bug reports.

MIT License — see LICENSE for details.

Noah Mills — Security+ Certified

Built as a healthcare cybersecurity portfolio project demonstrating practical risk assessment tooling for IoMT environments.