ARTICLE SUMMARY:
In this week’s roundup: FDA finalizes its long-awaited medical device cybersecurity guidance; what to expect in a government shutdown; lab-developed test debate drags on; and key updates and insights from Europe, UK, Asia, and IMDRF.
Top Pick: FDA Cyber Guide
FDA finalizes cross-cutting document
FDA issued its highly anticipated final guidance document on how cybersecurity needs to be integrated into a device manufacturers’ quality system and premarket submissions September 26, just days before the agency intends to start enforcing statutory cybersecurity requirements for new submissions. The guidance lays out in detail FDA’s expectations for embedding security into the design and testing for devices, introducing the concept of a Secure Product Development Framework and explaining the need to document a device’s “software bill of materials” (SBOM). Between the time when FDA issued a draft version in April 2022 and when it published the final guidance this week, Congress passed legislation that establishes cybersecurity testing and documentation as a legal requirement for premarket authorization of devices. The new statutory mandates technically took effect in March, but FDA previously announced it wouldn’t start turning away premarket submissions lacking key cyber elements until October 1. (A date that could be delayed by a US government shutdown, which blocks FDA from accepting new submissions —see below.) The final guidance is intended to map out exactly what companies need to do to comply with the new law. The approach is consistent with what FDA floated in the 2022 draft version, but adds additional details to align with industry best practices and to clarify documentation requirements and how to consider interoperability. The final version also adds language to make clear cybersecurity controls “should not be intended to prohibit a user from accessing their device data,” FDA says.
