In April 2022, the Food and Drug Administration (FDA) and the Center for Devices and Radiological Health (CDRH) jointly published new guidance on how to tackle growing concerns surrounding cybersecurity in medical devices.
With the exponential increase in the number of connected medical devices and the volume of confidential health information they transmit, the need for effective cybersecurity within medical device functionality and safety is more important than ever.
In recent years, cyber threats have risen sharply and the healthcare sector is one of many victims to experience more frequent, severe, and clinically impactful attacks. Cybersecurity incidents can render medical devices and hospital networks inoperable, which can impact the delivery and efficacy of patient care across the healthcare sector worldwide.
In this new guidance, device manufacturers are expected to have control of their software through their source code and backups. But if the use of third-party software components relinquishes any part of this control, a plan needs to be in place for how third-party software components could be updated or replaced.
To this end, the FDA suggest that manufacturers be required to document all of the software components used to build their medical devices, using the suggested format of a software bill of materials (SBOM).
The guidance is not only limited to network-enabled devices or those that contain other connected capabilities, but applies to all medical devices containing software, firmware or programmable logic, as well as software as a medical device (SaMD).
Aimed at improving medical device design, labeling, and a documentation for premarket submissions, these new FDA considerations will first result in a more efficient premarket review processes. In turn, this will ensure marketed medical devices are vastly better secured and more resilient to cybersecurity threats.
Following the FDA’s guidance, organizations can begin to address these concerns with a thoughtful SBOM strategy that provides a single pane of glass, affording high-level visibility into the risk and vulnerabilities within their software supply chain.
SBOMs are poised to soon become a standard across industries and will likely be mandated by organizations within the public sector, infrastructure, medical/healthcare, energy, finance, and more.
Knowing this, does your organization have full visibility into your software supply chain?
Do you have a SBOM Strategy that meets the requirements set out in the draft guidance?
Cybeats SBOM Studio can help provide software transparency, validation and certainty for the entire product lifecycle.
September 5, 2023
Unlocking the Potential: How SBOM Practices Revolutionize Tech Industries
Read More →August 15, 2023
We recently saw the publication of the National Cybersecurity Strategy Implementation Plan (NCSIP)
Read More →June 1, 2023
Last month I wrote about using a Software Bill of Material (SBOM) as a valuable tool for managing cybersecurity risk.
Read More →