FDA Cybersecurity in Medical Devices

​

Pacemakers, insulin pumps and other medical devices are becoming more advanced. Most contain software and connect to the internet, hospital networks, your mobile phone, or other devices to share information. Because of this, it is important to make sure medical devices are cybersecurity.

[The U.S. Food and Drug Administration] regulates medical devices and works aggressively to reduce cybersecurity risks in what is a rapidly changing environment. The FDA shares this responsibility with device manufacturers, hospitals, health care providers, patients, security researchers, and other government agencies, including the U.S. Department of Homeland Security's Cybersecurity & Infrastructure Security Agency (CISA) and U.S. Department of Commerce.

 

The FDA provides guidance to help manufacturers design and maintain products that are cyber secure. And on behalf of patients, the FDA urges manufacturers to monitor and assess cybersecurity vulnerability risks, and to be proactive about disclosing vulnerabilities and solutions to address them.

 

If a vulnerability or weakness in software, hardware or other factor that could pose a risk is identified, the FDA may issue what is called a “safety communication.” These messages contain information about the vulnerability and recommended actions patients, providers and manufacturers can take. The FDA has issued multiple cyber safety communications. The FDA wants to make these messages as helpful as possible without causing unnecessary worry or burden on patients.

​

This guidance document is applicable to devices that contain software (including firmware) or programmable logic, as well as software as a medical device (SaMD).

​

The guidance is not limited to devices that are network-enabled or contain other connected capabilities. This guidance describes recommendations regarding the cybersecurity information to be submitted for devices under the following premarket submission.

Premarket Notification (510(k)) submissions;

 • De Novo requests;

 • Premarket Approval Applications (PMAs) and PMA supplements;

 • Product Development Protocols (PDPs);

 • Investigational Device Exemption (IDE) submissions; and  Humanitarian Device Exemption (HDE) submissions.

 

 

FDA will assess the adequacy of the device’s security based on the device’s ability to provide and implement the security objectives below throughout the system architecture.

Security Objectives:

Authenticity, which includes integrity;

• Authorization;

• Availability;

• Confidentiality; and Secure and timely updatability and patchability.

​

Security testing documentation and any associated reports or assessments should be submitted in 822 the pre-market submission. FDA recommends that the following types of testing, among others, be provided in the submission:

1.Security requirements:

 a. Manufacturers should provide evidence that each design input requirement was implemented successfully.

 b. Manufacturers should provide evidence of their boundary analysis and rationale for their boundary assumptions.

2. Threat mitigation :

 a. Manufacturers should provide details and evidence of testing that demonstrates effective risk control measures according to the threat models provided in the system, use case, and call-flow views.

 b. Manufacturers should ensure the adequacy of each cybersecurity risk control (e.g., security effectiveness in enforcing the specified security policy,  performance for maximum traffic conditions, stability and reliability, as appropriate).

3. Vulnerability Testing (such as section 9.4 of ANSI/ISA 62443-4-1) :

 à Manufacturers should provide details and evidence  of the following testing pertaining to known vulnerabilities:

a. Abuse case, malformed, and unexpected inputs:

 (i) Robustness / (ii). Fuzz testing

b. Attack surface analysis

c.. Vulnerability chaining

d. Closed box testing of known vulnerability scanning

e. Software composition analysis of binary executable files, and Static and dynamic code analysis, including testing for credentials that are“hardcoded,” default, easily-guessed, and easily compromised.

4. Penetration testing:

The testing should identify and characterize security-related issues via tests that focus on discovering and exploiting security vulnerabilities in the product. Penetration test reports should be provided and include the following elements

a. Independence and technical expertise of testers,

b. Scope of testing,

c. Duration of testing

d . Testing methods employed, and Test results, findings, and observations