FDA updates recognized consensus standards

On June 7th, 2021, the FDA updated their database of recognized consensus standards. This update included two new items related to medical device software. These two items are IEEE standards that are relevant to all medical devices that claim interoperability with other networked entities. They are being recognized based on their scientific and technical merit since it aligns with existing regulatory policies.

IEEE Std 11073-40101-2020 Health informatics – Device interoperability Part 40101: Foundational – Cybersecurity – Processes for vulnerability assessment. (insert link)

This standard defines an approach for identifying cybersecurity vulnerabilities and estimating risk using the STRIDE classification scheme. The assessment includes system context, system decomposition, pre-mitigation scoring, mitigation, and post-mitigation scoring and iterates until the remaining vulnerabilities are reduced to an acceptable level of risk.

IEEE Std 11073-40102-2020 Health informatics – Device interoperability. Part 40102: Foundational – Cybersecurity – Capabilities for mitigation. (insert link)

This standard defines a security baseline of application layer cybersecurity mitigation techniques for certain use cases or for times when certain criteria are met. This standard provides a scalable information security toolbox appropriate for PHD/PoCD interfaces, which fulfills the intersection of requirements and recommendations from National Institute of Standards and Technology (NIST) and the European Network and Information Security Agency (ENISA). It maps to the NIST cybersecurity and STRIDE frameworks.

See another post on consensus standards:  FDA recognizes Defect Taxonomy Consensus Standard

Cybersecurity Review

Our cybersecurity experts are NESSUS Pro Licensed and can quickly remediate cybersecurity deficiencies with your medical device or digital health software.  Planning, requirements, validation, and submissions – we can assist with all.

Interested in having a conversation?  Email us to arrange a Zoom meeting or call us at +1 781-721-2921.

office@softwarecpr.com

Corporate Office

15148 Springview St
Tampa, FL 33624
USA
+1-781-721-2921
Partners located in the US (CA, FL, MA, MN), Canada, and Italy.