


Develop and approve a system security plan and an authorization to operate for the special-purpose system.
Verify that access control lists have been applied to network segments that contain medical systems.
Validate that appropriate physical and environmental security measures are implemented and functioning as intended.