Recognized Consensus Standards: Medical Devices

Part B: Supplementary Information Sheet (SIS)
FR Recognition List Number	056	Date of Entry 06/07/2021
FR Recognition Number	13-118
Standard
IEEE  Std 11073-40102:2020 Health informatics - Device interoperability. Part 40102: Foundational - Cybersecurity - Capabilities for mitigation.
Scope/Abstract Within the context of secure plug-and-play interoperability, cybersecurity is the process and capability of preventing unauthorized access or modification, misuse, denial of use, or the unauthorized use of information that is stored on, accessed from, or transferred to and from a PHD/PoCD. The capability part of cybersecurity is information security controls related to both digital data and the relationships to safety and usability. For PHDs/PoCDs, this standard defines a security baseline of application layer cybersecurity mitigation techniques for certain use cases or for times when certain criteria are met. This standard provides a scalable information security toolbox appropriate for PHD/PoCD interfaces, which fulfills the intersection of requirements and recommendations from National Institute of Standards and Technology (NIST) and the European Network and Information Security Agency (ENISA). This standard maps to the NIST cybersecurity framework [B15]; IEC TR 80001-2-2 [B8]; and the Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege (STRIDE) classification scheme. The mitigation techniques are based on the extended CIA triad (Clause 4) and are described generally to allow manufacturers to determine the most appropriate algorithms and implementations.
Extent of Recognition Complete standard
Rationale for Recognition This standard is relevant to all medical devices which claim interoperability with other networked entities and is being recognized on its scientific and technical merit because it supports existing regulatory policies.
Relevant FDA Guidance and/or Supportive Publications* Relevant guidance: 1. Design Considerations and Pre-market Submission Recommendations for Interoperable Medical Devices - Guidance for Industry and Food and Drug Administration Staff, issued September 2017. 2. Guidance for Industry and FDA Staff - Guidance for the Content of Premarket Submissions for Software Contained in Medical Devices, issued May 2005. 3. Off-The-Shelf Software Use in Medical Devices - Guidance for Industry and Food and Drug Administration Staff, issued September 2019. 4. Medical Device Data Systems, Medical Image Storage Devices, and Medical Image Communications Devices - Guidance for Industry and Food and Drug Administration Staff, issued September 2019. 5. Content of Premarket Submissions for Management of Cybersecurity in Medical Devices - Guidance for Industry and Food and Drug Administration Staff, issued October 2014. 6. Guidance for Industry - Cybersecurity for Networked Medical Devices Containing Off-the-Shelf (OTS) Software, issued January 2005. 7. Postmarket Management of Cybersecurity in Medical Devices - Guidance for Industry and Food and Drug Administration Staff, issued December 2016. Appropriate Use of Voluntary Consensus Standards in Premarket Submissions for Medical Devices - Guidance for Industry and Food and Drug Administration Staff, issued September 2018.
FDA Technical Contact  Maria Isabel Tejero Del Rio   FDA/OC/CDRH/OPEQ/OHTIII/   301-796-5322   Isabel.Tejero@fda.hhs.gov
Standards Development Organization IEEE Institute of Electrical and Electronic Engineers https://www.ieee.org/
FDA Specialty Task Group (STG) Software/Informatics
*These are provided as examples and others may be applicable.