Medical Device Cybersecurity through the FDA Lens
summary
Timeline of FDA actions since 2013: publication of premarket and postmarket guidances, three public workshops, an MOU with NH-ISAC, and MITRE support for a CDRH strategic initiative; April 2018’s Medical Device Safety Action Plan adds proposals to require evidence of patchability and consider length of support. FDA maps expectations to the NIST five functions, leverages the QSR (it does not independently test devices), has refused submissions for inadequate cybersecurity, and is pushing SBOMs, incident playbooks, and exercises after incidents like WannaCry and reported pacemaker vulnerabilities.
AI-written summary · about
chapters (8)
- 0:00Introduction to FDA mission
- 0:20Defining the scope
- 12:27Engaging stakeholders
- 13:26Regulatory frameworks
- 17:04Dispelling regulatory myths
- 18:52Navigating legacy challenges
- 38:19Cross-industry collaboration
- 40:14Preparedness and conclusion
related talks
45mTraceability In Cyber Security:Lessons Learned From The Medical Sector
13mNavigating the complex and rapidly evolving world of product and application security regulations
30mRisk, Evidence and Conformity
26mDiagnosing the Hurdles in the Medical Device Regulatory Landscape
59mMerging Security and Compliance: Perspectives on Emerging Regulations and Best Practices
01h 00mAdventures in Vulnerability Coordination
51mSecuring Medical Devices—When Cyber Really Is a Life and Death Issue
56mKeynote Presentation: What Vehicle Security Can Learn from Medical Device Security