FDA’s cybersecurity requirements for medical devices and when to comply with them

Contents

• What is FDA?
• The US standards landscape for medical devices
• When manufacturers need to comply with the FDA’s security requirements for medical devices

What is FDA?

The United States Food and Drug Administration (FDA) is a federal agency within the Department of Health and Human Services. The FDA is responsible for protecting and promoting public health through the control and supervision of medications, vaccines, biopharmaceuticals, medical devices, and other types of products. 

To ensure the safety and security of medical devices, the FDA supports a variety of standards and guidelines that medical device manufacturers are highly recommended to follow. If you don’t follow these guidelines, you won’t get market approval for the US market.

The US standards landscape for medical devices

Medical device manufacturers in the US must comply with numerous regulations and standards to ensure safety, security, and quality. Some of the key regulations and standards include:

1. FDA Regulations:
   • 21 CFR Part 820: Quality System Regulation (QSR) which includes Good Manufacturing Practices (GMP) for medical devices.
   • 21 CFR Part 11: Regulations on electronic records and electronic signatures.
   • 21 CFR Part 803: Medical Device Reporting (MDR) for reporting adverse events.
   • 21 CFR Part 806: Medical Device Corrections and Removals.
2. International Standards:
   • ISO 13485: Quality management systems for medical devices.
   • ISO 14971: Application of risk management to medical devices.
   • ISO 10993: Biological evaluation of medical devices.
3. Guidance Documents:
   • The FDA issues various guidance documents providing recommendations on design, development, testing, and post-market activities.
4. Cybersecurity Standards:
   • The FDA's guidance on cybersecurity for medical devices.
   • AAMI TIR57:2016: Principles for medical device security.
   • AAMI TIR 97:2019 Principles For Medical Device Security - Postmarket Risk Management For Device Manufacturers.

The first two of these cybersecurity standards advocate fuzz testing as a means of vulnerability and robustness testing. 

“Fuzz testing is state-of-the-art for testing robustness. Although you can write your own tests, you can never perform as many random and denial-of-service tests as you can with fuzzing. You must perform fuzz testing to prove to the FDA that your device is reliable and that the most common bugs are caught.”

Verena Wieser, Medical Device Consultant, Lorit Consultancy

Download this white paper to learn why fuzz testing is highly recommended for medical device security and how it aids in compliance with the FDA’s cybersecurity guidance and AAMI TIR 57:2016. Get free white paper.

When manufacturers need to comply with the FDA’s security requirements for medical devices

If your company plans to sell a medical device on the US market, it must comply with the FDA’s requirements. This is relevant in both cases:

1. When developing a new medical device and seeking market approval:
   • If the company is not compliant with the requirements, it risks failing the submission for market approval and not getting clearance for the US market. Resubmission implies extra costs and can take months.
2. When already selling devices on the US market. 
   • Medical device manufacturers undergo regular audit checks. If an auditor notices a nonconformity with any of the requirements, the company needs to resolve the nonconformity within a certain timeframe.

If a nonconformity is severe, the company might receive a warning letter, which is also published on the FDA’s website. In the worst-case scenario, the FDA can withdraw market approval, preventing the company from selling the devices in the US market.