FDA Updates Device Cybersecurity Activities
FDA says it is preparing a significant update to its guidance on “Content of Premarket Submissions for Management of Cybersecurity in Medical Devices.” For example, the new draft guidance will “highlight the utility of providing customers and users with a ‘cybersecurity bill of materials’ – a list of commercial or off-the-shelf software and hardware components of a device that could be susceptible to vulnerabilities,” FDA commissioner Scott Gottlieb said in an online post. “Depending on the level of cybersecurity risk associated with a device, this list can be an important resource to help ensure that device customers and users are able to respond quickly to potential threats. We look forward to comments from stakeholders on the updated recommendations and how the FDA can continue to advance our regulatory approach to keep pace with changing cybersecurity risks.”
The agency has also recently supported the development of a tool to help health care delivery organizations (HDOs), such as hospitals, better respond to medical device cybersecurity incidents — Medical Device Cybersecurity Regional Incident Preparedness and Response Playbook. The document describes the types of readiness activities that will enable HDOs to be better prepared for a cybersecurity incident involving their medical devices, Gottlieb says. These include steps such as developing a medical device inventory and conducting training exercises. The agency also developed its own internal playbook to help staff address cybersecurity threats, vulnerabilities and incidents.
Additionally, FDA has finalized two memoranda of understanding with multiple stakeholder groups to create information sharing analysis organizations (ISAOs) —expert groups that gather, analyze and disseminate important cybersecurity information. Gottlieb said that these sharing groups give manufacturers an opportunity to share information about potential vulnerabilities and emerging threats. “We believe this transparent sharing of information will help manufacturers address issues earlier and result in more protection for patients,” he said.