New FDA Guidance on Cybersecurity in Medical Devices

I hope this newsletter finds you well. We're dedicated to keeping you informed about significant regulatory updates that impact our industry. This issue of our newsletter dives into the FDA's latest draft guidance concerning cybersecurity in medical devices. The document, titled "Select Updates for the Premarket Cybersecurity Guidance: Section 524B of the FD&C Act," proposes critical changes aimed at bolstering the cybersecurity framework for medical devices. Here’s a link to the full guidance.

Overview of the Draft Guidance

The FDA has proposed updates to its existing guidance on cybersecurity in medical devices to incorporate new requirements under Section 524B of the FD&C Act. These changes emphasize the need for robust cybersecurity risk management throughout the lifecycle of medical devices, including more stringent requirements for software documentation and vulnerability management.

Proposed Changes

1. Clarification of Who Must Comply:

   • The guidance specifies that manufacturers submitting a premarket application for a "cyber device" must ensure compliance with stringent cybersecurity requirements.

   • A "cyber device" is defined as any device that includes software, can connect to the internet, or has technological characteristics that could be vulnerable to cybersecurity threats.

2. Detailed Documentation Recommendations:

   • Plans and Procedures: Manufacturers must submit a plan detailing how they will monitor, identify, and address postmarket cybersecurity vulnerabilities and exploits, including coordinated vulnerability disclosure.

   • Processes and Procedures for Assurance of Cybersecurity: There must be robust processes and procedures in place to maintain the cybersecurity of the device and associated systems.

   • Software Bill of Materials (SBOM): An SBOM must be provided, listing all software components in the device, including commercial, open-source, and off-the-shelf software.

3. Handling Modifications:

   • Guidelines are provided on documenting changes that may affect cybersecurity, ensuring that any modifications still comply with the stringent requirements of Section 524B.

4. Ensuring Ongoing Compliance:

   • Continuous updates and patching of vulnerabilities are required to maintain cybersecurity across the device's lifecycle.

   • Manufacturers must update their cybersecurity plans and documentation as new information becomes available or when changes occur in the device or its environment.

Relevance to Submission Requirements

These proposed changes ensure that all medical devices classified under the updated definition of "cyber devices" are held to current cybersecurity standards, reflecting the increasing complexity and connectivity of medical technologies. The documentation requirements are designed to ensure comprehensive coverage of all aspects of cybersecurity from premarket to postmarket stages.

These changes aim to improve the overall cybersecurity posture of medical devices by:

• Ensuring thorough initial assessment and continuous monitoring.

• Mandating clear and structured plans for vulnerability disclosure and response.

• Requiring detailed documentation of all software components to better manage and mitigate potential cybersecurity risks.

In essence, these updates not only align with the evolving cybersecurity landscape but also integrate cybersecurity more deeply into the regulatory framework for medical devices, thereby enhancing patient safety and data integrity.

Comparative Analysis of Cybersecurity Requirements

Most of my clients want to understand how this will affect what they are already doing and how this might relate to other regulations and standards they already comply with. The table below presents a comprehensive comparison of the existing FDA Cybersecurity Guidance Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions, the Draft Guidance  Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions, ANSI/AAMI/IEC 62304:2006 Medical device software - Software life cycle processes, and EU MDR Regulation (EU) 2017/745.

Requirement	FDA Released Guidance: Cybersecurity in Medical Devices	FDA Draft Guidance: Select Updates for the Premarket Cybersecurity	IEC 62304	EU MDR Requirements
Risk Management	Detailed security risk management plan including threat modeling, risk assessments, and mitigation measures.	Enhanced plans for monitoring and addressing postmarket cybersecurity vulnerabilities and exploits.	Risk management process integrated with software development, focusing on software safety.	Comprehensive risk management file as per Annex I, including cybersecurity risks.
System Requirements	Comprehensive description of security architecture, including security controls and cybersecurity testing outcomes.	No specific change; continues emphasis on detailed security requirements and cybersecurity assurance.	Software system requirements, including safety-related system requirements.	Device requirements must ensure safety and performance, implicitly including cybersecurity.
Software Description	Complete description of the device’s software, including all software components, both proprietary and third-party.	SBOM requirements enhanced to include detailed listings of all software components.	Detailed software architecture and software item descriptions.	Detailed description of device and software, focusing on integration and interactions.
Testing Documentation	Results from cybersecurity testing, such as vulnerability scanning and penetration testing.	Continues to require robust cybersecurity testing documentation, focusing on system and software changes.	Software verification and validation documentation, focusing on demonstrating safety and reliability.	Documentation of validation and verification testing, including cybersecurity where applicable.
Transparency Documentation	Labeling recommendations and management plans that communicate cybersecurity risks and management strategies.	Detailed plans and procedures for coordinated vulnerability disclosure included in premarket submissions.	Not specifically required; focuses more on internal documentation for development and maintenance.	Labeling must include information relevant to safety, which includes cybersecurity information.
Lifecycle Management	Plans for ongoing management of cybersecurity throughout the device’s lifecycle, including updates and patches.	Requirements for regular and emergency updates and patches to address known vulnerabilities.	Requirements for software maintenance, including problem resolution and software change processes.	Post-market surveillance system that includes monitoring of cybersecurity issues.
Software Bill of Materials (SBOM)	Requires an SBOM that lists all software components used in the device, detailing their security and maintenance status.	Mandatory SBOM provision detailing commercial, open-source, and off-the-shelf software components.	Not required under IEC 62304, although knowing components is part of sound software management.	Not explicitly required, but understanding software components can be part of the technical documentation.
Anomaly Documentation	Security assessment of unresolved anomalies and their impact on device safety and effectiveness.	Explicit requirements for documenting changes impacting cybersecurity and procedures for vulnerability disclosures.	Documentation of software anomalies, part of problem resolution during maintenance.	Analysis of potential risks associated with anomalies, included in the risk management system.
Post-Market Surveillance	Monitoring for cybersecurity issues as part of post-market surveillance activities.	Emphasis on enhanced post-market monitoring and management of cybersecurity issues.	Monitoring for software functionality and safety in post-market phase.	Systematic post-market surveillance required, including ongoing cybersecurity vigilance.
General Safety and Performance Requirements (GSPR)	N/A	Several key sections address cybersecurity requirements including general requirements, Sections 17.2 and 17.4	N/A	N/A

Conclusion

The proposed updates signify a robust shift towards more proactive and comprehensive management of cybersecurity risks in medical devices. By enhancing transparency and requiring detailed documentation, these changes aim to fortify the security of medical devices against emerging cyber threats.

For any further questions or clarification, please reach out 😊

Thanks!