FDA Issues Final Guidance Document on Cybersecurity Requirements for Premarket Device Submissions

The Food and Drug Administration (FDA) has issued finalized guidance aimed at helping device developers comply with newly enacted cybersecurity requirements for premarket submissions. The guidance details the use of a secure product development framework to manage cybersecurity risks, addressing aspects such as risk management, security architecture, and cybersecurity testing.
Congress recently granted the FDA the authority to issue “refuse to accept” decisions for applicants failing to provide necessary cybersecurity information for medical devices. The FDA plans not to exercise this authority until after October 1, 2023. Given the extremely short timeline from release of the final guidance document, it is not clear if this date may change to give device companies time to implement the new guidelines.
The finalized guidance replaces a 2014 guidance document, acknowledging the rapidly changing cybersecurity landscape and emerging threats in the field. In the guidance document, the FDA cites specific threats including vulnerabilities in widely-used third-party components referencing URGENT/11 with IPnet. In 2019 the agency issued a safety advisory about this issue after researchers at Armis Security discovered 11 vulnerabilities (URGENT/11), collectively, in IPnet, a third-party software component used for network communications between computers. These vulnerabilities posed significant security risks, potentially enabling remote takeover of medical devices, alteration of device functions, denial of service attacks, information leaks, and logical flaws that could impair device functionality.
The document also references risks identified in a report issued by the Cybersecurity and Infrastructure Security Agency (CISA) in 2020 after the agency became aware of a public release detailing multiple Bluetooth Low Energy (BLE) vulnerabilities, accompanied by proof-of-concept (PoC) exploit code. These vulnerabilities impacted a wide range of items including smart-home, wearable, and medical devices that employed BLE wireless communication technology. The vulnerability family was known as SweynTooth and consiststed of 12 vulnerabilities. The vulnerabilities within SweynTooth could potentially allow an attacker within radio range to trigger various issues, such as deadlocks, crashes, buffer overflows, or even complete security bypasses. The affected devices included pacemakers and blood glucose monitors critical to patient health.