Device Cybersecurity is Top Concern for Shuren
CDRH director Jeff Shuren says one of the biggest concerns that keeps him up at night is medical device cybersecurity. Speaking at 3/23 Alliance for Stronger FDA Webinar, Shuren said the recent omnibus budget bill provided FDA with $5 million to finally build a desperately needed cybersecurity program. He noted that between 2016 and 2020, the Department of Homeland Security found that there was a 17-fold increase in cybersecurity vulnerabilities for medical devices. “And we are monitoring several vulnerabilities at any point in time…, and now we will have the resources to really put more time and attention in it,” he said, adding that as more technologies become digital, the cybersecurity risk increases.
Shuren said that beginning 3/29, two new cybersecurity requirements mandated by the 12/29/2022 Food and Drug Omnibus Reform Act (Section 3305) go into effect. One requires device companies to include in submissions their “software bill of materials,” including commercial, open-source, and off-the-shelf software components, so device users know if there is a problem with certain software, they can more easily determine which devices may be affected. The other new requirement calls for the submission of firms’ plans to monitor, identify, and address postmarket cybersecurity vulnerabilities and exploits, including coordinated vulnerability disclosure and related procedures.
Shuren noted that there are important resources already on FDA’s Web site, adding that more information is coming out soon. In the meantime, he said submissions that do not contain the information will not be rejected as a “refuse to file” through the rest of the fiscal year. “This will allow firms to get up to speed on the new requirements, and we will be here to work with you if have got questions,” he said.
Shuren also told the Webcast that it is imperative to continue to work with Congress to update the agency’s 47-year-old device law to provide more flexibilities to get new device technologies on the market more efficiently. He said CDRH needs flexibility like it had during the Covid-19 health emergency to be successful with regulating new technologies in the future.
Asked to explain what a new, more modern approach to regulating medical technologies would look like, Shuren said a “voluntary alternative pathway” is most viable. “First of all, you’re not changing the regulatory standard to market in the U.S. — reasonable assurance of safety and effectiveness remains,” he explained. “And the overarching principle of ‘least burdensome’ stays in place, and it must be a voluntary pathway. So, if you’re a developer, you could choose this alternate pathway, but you don’t lose the options you have today, you would just get another option.”
Shuren said the new pathway would provide flexibility to fit the technology. “During Covid, what we could do with EUAs was to take this one authority and craft it much better to the technology itself … to allow us to do some things we couldn’t do before.” For example, he said that under the alternative approach, there could be cases where the capability of the manufacturer could be used in lieu of some of the requirements that today are looked at on a product-by-product basis. Shuren called this the “technology certification,” and once a firm is certified, they do not need to come back to FDA with tests within that particular category.
Additionally, Shuren said such an alternative pathway would look at mechanisms for leveraging better post-market data. There are things about quality systems that could be leveraged that could not be done with today’s framework, he added. “So essentially, it would provide general authority so we can build the pathways for the technology, which would be put out there in guidance, and then if you’re in that category, you could choose to go down this path, or stick with the traditional pathway.”
Moving on to device user fees, Shuren said that one of the most exciting programs under the latest iteration of the Medical Device User Fee Act (MDUFA 5) is the recently launched Total Product Life Cycle Advisory Program (TAP) pilot, which is intended to make device commercialization more efficient and more predictable. He said the pilot is also based on lessons learned from the Covid-19 emergency, such as providing industry with earlier and more frequent interactions with CDRH, and proactive, strategic advice from the Center to help achieve more rapid development of innovative medical devices first in the world that are critical to public health.
TAP was launched in January and it is intended to enroll up to 15 devices in the Office of Cardiovascular Devices. So far, Shuren said, four device companies are taking part. “You’ve got to get the perspectives of the key stakeholder groups involved early on, and along the way,” he says. “Some companies do it well and some need some help, and so we’re offering the opportunity to get connected and bring the right patient groups, provider groups, and payers into the discussion to provide feedback for the developers.”