Similar to hazards, cybersecurity threats and vulnerabilities cannot be eliminated entirely but must be managed and reduced to a reasonable level.[77] When designing medical devices, the tier of cybersecurity risk should be determined early in the process in order to establish a cybersecurity vulnerability and management approach (including a set of cybersecurity design controls). The medical device design approach employed should be consistent with the NIST Cybersecurity Framework for managing cybersecurity-related risks.