FDA Announces New Cybersecurity Requirements for Medical Devices

The US Food and Drug Administration (FDA) has announced that medical device manufacturers will now be required to fulfill certain cybersecurity standards when presenting an application for a new product. This decision has been taken in order to ensure the safety and security of the medical devices that are being introduced into the market. The FDA has identified the need for enhanced cybersecurity measures due to the growing number of cyber threats and attacks that have been witnessed in recent years. The new regulations will require manufacturers to incorporate robust security features and practices into their devices to prevent any potential cyber breaches. The FDA is hopeful that this move will not only protect patients but also create a more secure and trustworthy healthcare system.

The agency issued guidance on March 30, which outlines new requirements that are a result of the Consolidated Appropriations Act. This act was signed into law in late 2022 and includes a section called "Ensuring Cybersecurity of Medical Devices", which made changes to the Federal Food, Drug, and Cosmetic Act. The purpose of these requirements is to enhance the cybersecurity of medical devices.

The FDA has mandated that new medical device submissions must provide comprehensive information regarding cybersecurity, including the provision of a plan that outlines the identification and resolution of potential security threats and exploits within a reasonable timeframe.

It is important for companies to disclose the methods and protocols they use to issue updates and patches after a product has been released in the market. This includes the provision of routine updates and the issuance of out-of-band patches specifically designed to address critical vulnerabilities and security concerns.

As part of the information required by the FDA, a comprehensive software bill of materials (SBOM) for all commercial, open source, and pre-manufactured components must be provided.

The criteria are relevant to devices that are capable of connecting to the internet, run software, and have the potential to be susceptible to digital security hazards, commonly known as cyber devices.

Guidance Document