PARAVA – NEW WEBSITE – FDA CYBER REGULATION

The FDA requires medical device manufacturers who submit device applications to the FDA under section 510(k), 513, 515(c), 515(f), or 520(m) and meet the definition of a ‘cyber device’,   meaning devices that have software installed; have the ability to connect to the internet and have technical characteristics that could result in a vulnerability to cybersecurity threats.  Where this is the case the manufacturer or sponsor of an application must.

• Submit a plan as to how they will monitor, identify, and address as appropriate, in a reasonable time, post market cybersecurity vulnerabilities and exploits, including coordinated vulnerability disclosure and related procedures.
• Design, develop, and maintain processes and procedures to provide a reasonable assurance that the device and related systems are cybersecure. By making available post market updates and patches to the device and related systems to address known unacceptable vulnerabilities, and critical vulnerabilities that could cause uncontrolled risks.
• Provide a software bill of materials (SBoM), including commercial, open-source, and off-the-shelf software components.
• Comply with such other requirements as the FDA may require through regulation to demonstrate reasonable assurance that the device and related systems are cybersecure.

This is a significant development for medical device manufacturers globally.  It opens the way for the FDA to mandate cybersecurity risk management of medical devices that includes vulnerability and patch management, the management of the Software Development Lifecycle and attestation over product cybersecurity.