Medical Devices: FDA and EU MDR/IVD Compliance
Industry: Medical Device
In response to attacks on medical devices, regulators around the globe are implementing cybersecurity requirements that push manufacturers to develop devices that are resilient and able to protect patient safety and privacy. The FDA in the United States and European Union requirements, like theMedical Devices Regulation (MDR) and In Vitro Diagnostic Medical Devices Regulation (IVDR), focus on a lifecycle approach to medical device software development, with requirements from design through to postmarket. RunSafe Security provides medical device manufacturers cybersecurity solutions to maintain compliance with FDA and EU requirements while reducing the risks associated with delayed patching and supply chain vulnerabilities.
Challenge
The FDA now requires that manufacturers provide a Software Bill of Materials (SBOM) that lists all commercial, open-source, and off-the-shelf software components. For medical devices, especially legacy ones and those written in C/C++, generating SBOMs is a challenge.
Additionally, in the U.S. and the EU, regulators are focusing on a total lifecycle approach to device security, requiring risk management and security measures from product design to post-market monitoring. Vulnerability identification and patching devices post-market is particularly challenging, demanding significant developer time and resources.
“From our perspective, adding RunSafe means we have more opportunity to shrink the attack surface and reduce overall risks for our customers since security is now already built into our product.”
Key Features:
Complete Software Bill of Materials
Pre-market submissions / post-market management
Automated mitigation and code protection
Solution
RunSafe helps medical device manufacturers achieve FDA approval and EU compliance by integrating automated vulnerability mitigation and code protection measures, enabling compliance with Secure by Design requirements and accelerating a secure go to market process.
Key features of RunSafe’s solution include:
- Build-time Software Bill of Materials: RunSafe’s build-time SBOMs for C/C++ generate a complete list of all applications, libraries, and files used during a chosen build, including information about the source material, target, and dependencies.
- Automated vulnerability identification: RunSafe’s technology identifies vulnerabilities present in software and quantifies available risk reductions, allowing medical device manufacturers to prioritize mitigations and move forward with software releases.
- Continuous protection for legacy and new medical devices: RunSafe applies Load-time Function Randomization to proactively safeguard medical devices throughout the device lifecycle from the entire class of memory safety vulnerabilities—even before patches are available This allows manufacturers to streamline the patching and update process, knowing that even if vulnerabilities are found, they are safe from exploitation with RunSafe Protect deployed.
Examples
Automated mitigation and risk reduction: A medical device company was seeking a way to accelerate its time to FDA approval by dramatically reducing its attack surface and minimizing the severity of vulnerabilities so it can optimize its scanning, fixing, and patching processes. With RunSafe, its devices are protected from exploitation for both known and unknown vulnerabilities.
Addressing software supply chain risk: One product security team leveraged RunSafe’s Software Security Platform for embedded developers to extend its return on investment by rolling out a centralized way to generate SBOMs, identify vulnerabilities, and integrate vulnerability mitigation within its build tools.
Latest Resources
RunSafe Security Joins the Maritime Hacking Village at DEF CON 33
Ahoy, Vegas. RunSafe Security is headed to DEF CON 33 and we’re bringing serious energy to the high seas of cyber. This year, we’re proud to sponsor the Maritime Hacking Village (MHV), the destination at DEF CON for hackers, engineers, and tinkerers who want to get...
Making Secure by Design Practical: How We’re Building Resilient Software
As cyber threats increase in scale and impact, building security into software from the start has become more than best practice—it’s a national security imperative. RunSafe Security is a signee of the CISA Secure by Design pledge, Here’s what we’ve learned by living...
How to Strengthen Your Embedded Software Security
From medical devices and aerospace systems to industrial controls and automotive ECUs, embedded systems are the unsung heroes of modern technology. But with that ubiquity comes risk. Threat actors increasingly target embedded software, like firmware, bootloaders, OS...