A security indicator is a sign that shows us what something is like or how a situation is changing and can aid us in making informed estimations on cyber risks. There are many different breeds of security indicators, but, unfortunately, they are not always easy to apply due to a lack of available or credible sources of data. This paper undertakes a systematic mapping study on the academic literature related to cyber security indicator data. We identified 117 primary studies from the past five years as relevant to answer our research questions. They were classified according to a set of categories related to research type, domain, data openness, usage, source, type and content. Our results show a linear growth of publications per year, where most indicators are based on free or internal technical data that are domain independent. While these indicators can give valuable information about the contemporary cyber risk, the increasing usage of unconventional data sources and threat intelligence feeds of more strategic and tactical nature represent a more forward-looking trend. In addition, there is a need to take methods and techniques developed by the research community from the conceptual plane and make them practical enough for real-world application.

MDCG 2019-16 is intended to assist practitioners in compliance with the Medical Device Regulation and the In-Vitro Device Regulation. This paper presents a gap analysis of MDCG 2019-16, identifying key gaps and proposing a robust set of recommendations to enhance the IoMT regulatory framework. This work has been undertaken by a selection of current (2023-2025) projects, all funded under the Horizon Europe call “Enhancing cybersecurity of connected medical devices”: HORIZON-HLTH-2022-IND-13-01, and this paper summarises observations and recommendations from across these projects. There is considerable consensus across the projects in many recommendation themes, notably; linking cybersecurity with patient safety and privacy; keeping the guidelines current; and usage recipes for the guidelines. The paper also suggests toolkit solutions to address some of the recommendations.