> For the complete documentation index, see [llms.txt](https://docs.medcrypt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.medcrypt.com/medcrypt-documentation/medisao/medisao.md).
# MedISAO overview
MedISAO is an Information Sharing and Analysis Organization (ISAO) for the medical device community. An ISAO is a group that collects and shares cybersecurity threat information among its members. FDA's postmarket cybersecurity guidance recommends that manufacturers take part in one. MedISAO gives members vulnerability intelligence, curated security advisories, a coordinated vulnerability disclosure (CVD) program, and reference documents, all in the same app as MSI.
## Who MedISAO is for
* **Medical device manufacturers:** Product security teams that track vulnerabilities in the components their devices use, receive vulnerability reports from outside researchers, and publish fixes and guidance to the hospitals that run their devices.
* **Security researchers and other reporters:** Anyone who has found a vulnerability in a medical device and wants to report it confidentially through **Report Vulnerability**.
## How you reach MedISAO
How MedISAO looks depends on the kind of workspace you are in. A workspace's product tier is set per workspace, so switching workspaces can change what you see.
### MedISAO-only workspaces
If your workspace has a MedISAO-only subscription, the whole app is MedISAO:
* The sidebar is a flat list: **Medisao** (the home page), **CVE Search**, **Product Search**, **Advisories**, **Devices**, **VIPER Channels**, **Library**, **Report Vulnerability**, and **CVD Management**.
* **Notifications** and **Settings** are icons next to your profile instead of sidebar rows.
* The app always uses light mode.
* MSI pages such as threat modeling and eSTAR readiness aren't available. If you open a link to one, the app sends you back to the MedISAO home page.
The home page, **Information Sharing and Analysis for the Medical Device Community**, has shortcut cards to the **CVE Database**, **Security Advisories**, **Documents**, and **Report Vulnerability**.
### Full-platform workspaces
If your organization has MSI and its plan also includes MedISAO, the MedISAO pages appear in a collapsible **Medisao** section in the sidebar, next to your other sections. If your organization's plan doesn't include MedISAO, the section doesn't appear.
## How the pieces fit together
1. **Find out what's affecting you.** Use **CVE Search** and **Product Search** to look up vulnerabilities by keyword, vendor, product, or package. Use **Advisories** to read curated security advisories.
2. **Receive reports.** Researchers submit through **Report Vulnerability**, or through your organization's own branded disclosure portal. Reports assigned to your organization show up in **CVD Management**, where you triage them and keep the reporter informed.
3. **Tell hospitals what to do.** Once a disclosure is fixed or handled, turn it into an advisory on the **VIPER Channels** page, add remediations with clinical-impact details, publish them, and answer hospitals' questions.
{% hint style="info" %}
MedISAO uses the Traffic Light Protocol (TLP) to mark how widely information can be shared. TLP:CLEAR (or TLP:WHITE) is public, TLP:GREEN is for the community, TLP:AMBER is limited, and TLP:RED is restricted to named recipients. The pages that use TLP explain what it controls there.
{% endhint %}
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.medcrypt.com/medcrypt-documentation/medisao/medisao.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.