On Jan. 15, the U.S. Food and Drug Administration (FDA) issued draft guidelines regarding the cybersecurity of medical devices. These guidelines cover both the design of a medical device as well as their maintenance.

Security Concerns

In its recent announcement, the FDA detailed its recommendations for monitoring, identifying and addressing cybersecurity vulnerabilities in a medical device once it has entered the market.

“The draft guidance is part of the FDA’s ongoing efforts to ensure the safety and effectiveness of medical devices, at all stages in their life cycle, in the face of potential cyberthreats,” the release said. Including the phrase “all stages” means that the FDA is not going to ignore necessary updates and maintenance of these devices — it is dedicated to securing equipment no matter what.

The guidelines outlined recommendations for medical device manufacturers, including the need to proactively plan for and assess cybersecurity vulnerabilities, which is consistent with the FDA’s Quality System Regulation. The draft also suggested manufacturers implement a “structured and systematic comprehensive cybersecurity risk management program and respond in a timely fashion to identified vulnerabilities.”

The 25-page draft is for comment only, according to the FDA. The agency plans to hear public comment at its upcoming workshop “Moving Forward: Collaborative Approaches to Medical Device Cybersecurity,” held Jan. 20–21 at the agency’s headquarters in Silver Spring, Maryland. This will be followed by a 90-day comment period.

The FDA stressed the value of information sharing via participation in an Information Sharing Analysis Organization (ISAO). This is a collaborative group in which public- and private-sector members share cybersecurity information.

Getting Specific

The specific recommendations include applying the Framework for Improving Critical Infrastructure Cybersecurity from the National Institute of Standards and Technology (NIST). This included the five core principles: identify, protect, detect, respond and recover. Under that broad umbrella, the NIST placed actions such as monitoring cybersecurity information sources for vulnerabilities and risks, understanding the impact of a vulnerability and establishing processes to handle these issues.

Just how organizations go about completing those tasks is left vague, however. Similarly, distinguishing how advancements such as mobile apps fit into this framework is not clear. This is likely something the FDA will address in the future, but for now, the focus is on medical devices themselves.

Just the Beginning

The draft is just that — a draft. Now, the FDA must start to persuade industry players to do things the proper way. This is sort of new territory for the agency, and simply issuing regulations without accepting feedback will lead to intransigence. If the FDA wants this conversational approach to work, it will have to give players some functional grease to allow them to fit into the framework.