Free Podcast: Cybersecurity challenges and opportunities for medical device companies in 2022
Dr Kevin Fu, Acting Director of Medical Device Cybersecurity at the US Food and Drug Administration, talks exclusively to the JMDR in our latest expert podcast session conducted by Christopher Fulmer.
In this interview, hear Dr Fu answer the following questions:
- What agencies in the USA does the FDA interact with to help ensure cybersecurity issues and threats are addressed?
- What role do each of these entities have in helping to provide cybersecurity?
- In your opinion, what are some of the improvements that could be made with how the various agencies interact on cybersecurity issues?
- On a global basis, what organisations and/or agencies does the FDA interact with on cybersecurity?
- What are some of the key measures medical device companies can implement to help prevent cyberattacks and how will these measures help improve cybersecurity?
- Recently (Nov 30) you published a link to a white paper on threat modelling. What are your expectations for manufacturers relating to this document?
- Has any progress been made on what will be required for a manufacturer’s CBOM/SBOM? Will an online version be acceptable? Will there be an agreement by all IMDRF members to provide the same document?
- There are many recalls relating to cybersecurity issues and medical devices. Has there ever been a death associated with a cybersecurity issue with a medical device?
- What is FDA’s expectation for vulnerability management? What is an acceptable timeframe to provide fixes to software?
- Is penetration testing by third parties a de facto requirement for medical device submissions?
- What is the FDA doing to proactively stay ahead of potential cyberattacks at large medical institutions where if there was a breach the safety of thousands of patients could be at risk?
- Which devices are particularly susceptible to cybersecurity concerns not only today but in the near future due to advances in device-device communications?
- What is the best way for professionals to maintain currency with evolving cybersecurity standards?
- From an academic standpoint, what should an institution ensure appears in its MSc in Regulatory Affairs curriculum?
- When do you expect the agency to issue draft guidance on cybersecurity issues? What are some of the key issues you anticipate the draft guidance to address?
