Medical Devices: FDA and EU MDR/IVD Compliance
Industry: Medical Device
In response to attacks on medical devices, regulators around the globe are implementing cybersecurity requirements that push manufacturers to develop devices that are resilient and able to protect patient safety and privacy. The FDA in the United States and European Union requirements, like theMedical Devices Regulation (MDR) and In Vitro Diagnostic Medical Devices Regulation (IVDR), focus on a lifecycle approach to medical device software development, with requirements from design through to postmarket. RunSafe Security provides medical device manufacturers cybersecurity solutions to maintain compliance with FDA and EU requirements while reducing the risks associated with delayed patching and supply chain vulnerabilities.
Challenge
The FDA now requires that manufacturers provide a Software Bill of Materials (SBOM) that lists all commercial, open-source, and off-the-shelf software components. For medical devices, especially legacy ones and those written in C/C++, generating SBOMs is a challenge.
Additionally, in the U.S. and the EU, regulators are focusing on a total lifecycle approach to device security, requiring risk management and security measures from product design to post-market monitoring. Vulnerability identification and patching devices post-market is particularly challenging, demanding significant developer time and resources.
“From our perspective, adding RunSafe means we have more opportunity to shrink the attack surface and reduce overall risks for our customers since security is now already built into our product.”
Key Features:
Complete Software Bill of Materials
Pre-market submissions / post-market management
Automated mitigation and code protection
Solution
RunSafe helps medical device manufacturers achieve FDA approval and EU compliance by integrating automated vulnerability mitigation and code protection measures, enabling compliance with Secure by Design requirements and accelerating a secure go to market process.
Key features of RunSafe’s solution include:
- Build-time Software Bill of Materials: RunSafe’s build-time SBOMs for C/C++ generate a complete list of all applications, libraries, and files used during a chosen build, including information about the source material, target, and dependencies.
- Automated vulnerability identification: RunSafe’s technology identifies vulnerabilities present in software and quantifies available risk reductions, allowing medical device manufacturers to prioritize mitigations and move forward with software releases.
- Continuous protection for legacy and new medical devices: RunSafe applies Load-time Function Randomization to proactively safeguard medical devices throughout the device lifecycle from the entire class of memory safety vulnerabilities—even before patches are available This allows manufacturers to streamline the patching and update process, knowing that even if vulnerabilities are found, they are safe from exploitation with RunSafe Protect deployed.
Examples
Automated mitigation and risk reduction: A medical device company was seeking a way to accelerate its time to FDA approval by dramatically reducing its attack surface and minimizing the severity of vulnerabilities so it can optimize its scanning, fixing, and patching processes. With RunSafe, its devices are protected from exploitation for both known and unknown vulnerabilities.
Addressing software supply chain risk: One product security team leveraged RunSafe’s Software Security Platform for embedded developers to extend its return on investment by rolling out a centralized way to generate SBOMs, identify vulnerabilities, and integrate vulnerability mitigation within its build tools.
Latest Resources
The Top 6 Risks of AI-Generated Code in Embedded Systems
AI is now woven into the everyday workflows of embedded engineers. It writes code, generates tests, reviews logs, and scans for vulnerabilities. But the same tools that speed up development are introducing new risks—many of which can compromise the stability of...
Beyond the Battlefield: How Generative AI Is Transforming Defense Readiness
When people picture AI in defense, they usually imagine automated drones, robotic soldiers, or high-stakes scenarios at the edge of conflict. But generative AI’s biggest impact today isn’t on the front lines at all but in the workflows, decisions, and systems behind...
Meeting ICS Cybersecurity Standards With RunSafe
Meeting ICS cybersecurity standards, such as IEC 62443 and NIST 800-82, requires more than just documenting policies or checking boxes. Industrial control systems rely on complex, layered software stacks—much of it legacy, third-party, or built with older...