The FDA Guidance on "Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions" was issued on September 27, 2023. The release is just before the Refuse-To-Accept (RTA) would start on October 1 for submissions that do not meet the litmus test for medical devices. When guidance documents are issued, the intent is to provide recommendations that may help achieve compliance while allowing Medical Device Manufacturers (MDM) the latitude to implement section 524B of the FD&C Act. Software-Bill-of-Materials (SBOMs) was included in the Act and must be part of every submission. SBOMs list all the software components used in a particular product, application, or system. It is a complete inventory of all the software that makes up the product, including open-source components, third-party libraries, and proprietary software. The purpose of an SBOM is to provide transparency and traceability for the software supply chain, enabling MDMs to identify potential security risks and manage them effectively.
The guidance issued several security controls that may help with compliance: authentication, authorization, cryptography, code data, execution integrity, confidentiality, event detection, logging, resiliency and recovery, updateability, and patchability. In addition to the SBOM, the MDM should include security controls in the guidance as part of a security-by-design approach. When conducting a risk assessment, the MDM should evaluate the safety and cybersecurity risks of the medical device and explain any residual risks. A safety risk is the possibility of an event or activity causing harm or injury to people, property, or the environment. Cybersecurity risk refers to the potential for sensitive data to be stolen, damaged, or otherwise compromised through an electronic attack. This risk can occur through various channels, including hacking, phishing, and malware attacks. When considering these types of risks, safety and data should always be based on the medical device you are evaluating and the current threat landscape. Please refer to Parts I & II of this video series to understand the importance of complying with the Act and how to implement a security-by-design approach.
From a safety perspective, the guidance mentions ISO 14971 as a standard in the risk management process for medical devices. This process includes identifying hazards and estimating and evaluating risks associated with the device. The standard recommends identifying potential hazards, assessing risks, and developing risk control measures to eliminate or reduce the risk of harm to patients, users, and other stakeholders. Annex C of the standard provides a master table of hazards and a sequence of events that can lead to hazardous situations. The risk management process also considers the type, severity, and exposure to the situation. Overall, ISO 14971 provides a comprehensive approach to managing risks associated with medical devices to ensure their safety and effectiveness.
From a cybersecurity perspective, the government standard in NIST 800-53 and its associated security controls assist with identifying security requirements for a medical device. While the guidance issued 12 security control families, NIST 800-53 has 20, and the MDM should decide what is most relevant based on the medical device they are evaluating.
From a threat perspective, the guidance mentions threat modeling as a structured approach for identifying and prioritizing potential threats to a medical device. Threat modeling aims to identify vulnerabilities and possible attacks to help MDMs understand their risks and implement appropriate security controls.
The process of threat modeling typically involves the following steps:
1. Identify the medical device to be modeled.
2. Develop a data flow diagram to identify the data flow and interactions between different components.
3. Identify potential threats to the system or application, such as unauthorized access, data theft, or denial of service attacks.
4. Evaluate the potential impact of each threat and prioritize them based on the likelihood of occurrence and severity of impact.
5. Develop mitigation strategies to address the identified threats, such as implementing controls found in NIST 800-53 and a subset in the guidance document.
6. Test the effectiveness of the mitigation strategies and refine them as necessary.
In conclusion, complying with the FDA guidance on cybersecurity in medical devices is crucial for MDMs. The guidance outlines specific security controls and requires that SBOMs be included in every submission. MDMs should also consider safety and cybersecurity risks when conducting a risk assessment to ensure the safety and effectiveness of their medical devices. Adhering to standards like ISO 14971 and government standards like NIST 800-53 can help MDMs manage these risks effectively. Finally, threat modeling is a valuable tool that can help MDMs identify and prioritize potential security threats and develop appropriate mitigation strategies to protect against them. By implementing a security-by-design approach, MDMs can ensure the safety and security of their medical devices and protect against potential attacks that could compromise patient data or cause harm to patients.