This month the FDA released a draft guidance on managing cybersecurity in Medical Devices (“Content of Premarket Submissions for Management of Cybersecurity in Medical Devices”; download the draft here). The guidance will available for public comment under Docket FDA-2018-D-3443 starting on October 18, 2018 until March 18, 2019. When finalized, this draft will replace the original version of the guidance issued in October 2014 (find it here). The purpose of the update is to address the expanded range of possible avenues of threat and the increase in frequency, severity and impact of actual incidents. Changes include additional definitions and revision of the text to emphasize the manufacturer’s responsibilities for evaluating and maintaining cybersecurity for their devices. Important recommendations in the draft include:

• A tiered system for classifying devices for their cybersecurity risk, 
• Guidance for application of the NIST cybersecurity framework,
• Recommendations for preventing unauthorized use of the device through its software, ensuring trusted content through code maintenance, and maintaining data confidentiality,
• Approaches to device design that enable detection of, response to, and recovery from cybersecurity events, and
• Enhancements to documentation, including a Cybersecurity Bill of Materials (CBOM), which supports compliance with purchasing controls for conformance of items with specified cybersecurity requirements. The agency feels the CBOM could become a critical element in identifying cybersecurity assets, threats, and vulnerabilities in the future.

There is a public workshop on the draft guidance planned for January 29-30, 2019. Interested parties may register to attend the meeting in person or join the webcast version. This new draft includes significant new material and is an important part of the agency’s increased emphasis on cybersecurity. Anyone using software as part of their medical device should review the document and provide thoughtful comment.

Text Copyright © 2018 Katrina Rogers