• Decrease font size
  • Return font size to normal
  • Increase font size
U.S. Department of Health and Human Services

Recognized Consensus Standards

  • Print
  • Share
  • E-mail
-
Super Search Devices@FDA
510(k) | DeNovo | Registration & Listing | Adverse Events | Recalls | PMA | HDE | Classification | Standards
CFR Title 21 | Radiation-Emitting Products | X-Ray Assembler | Medsun Reports | CLIA | TPLC
 

New Search Back To Search Results
Part B: Supplementary Information Sheet (SIS)
FR Recognition List Number 056 Date of Entry 06/07/2021 
FR Recognition Number 13-117
Standard
IEEE Std 11073-40101-2020
Health informatics - Device interoperability Part 40101: Foundational - Cybersecurity - Processes for vulnerability assessment.
Scope/Abstract
Within the context of secure plug-and-play interoperability, cybersecurity is the process and capability of preventing unauthorized access or modification, misuse, denial of use, or the unauthorized use of information that is stored on, accessed from, or transferred to and from a PHD/PoCD. The process part of cybersecurity is risk analysis of use cases specific to a PHD/PoCD.

For PHDs/PoCDs, this standard defines an iterative, systematic, scalable, and auditable approach to identification of cybersecurity vulnerabilities and estimation of risk. This iterative vulnerability assessment uses the Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege (STRIDE) classification scheme and the embedded Common Vulnerability Scoring System (eCVSS). The assessment includes system context, system decomposition, pre-mitigation scoring, mitigation, and post-mitigation scoring and iterates until the remaining vulnerabilities are reduced to an acceptable level of risk.
Extent of Recognition
Partial recognition. The following part(s) of the standard is (are) not recognized:
Subclause 8.6 Iteration
Rationale for Recognition
This standard is relevant to all medical devices which claim interoperability with other networked entities and is being recognized on its scientific and technical merit because it supports existing regulatory policies.

This standard is recognized in part because:
Subclause 8.6 is in conflict with an existing published final guidance, see Section VII.B Uncontrolled Risk to Safety and Essential Performance of the guidance listed below (#7).

Subclause 8.6 is also in conflict with other recognized standards:
- see subclause 6.6 (Risk/benefit analysis) of AAMI TIR57:2016 listed below (#8),
- see subclause 7.3 (Residual risk evaluation) of ANSI AAMI ISO 14971:2019 listed below (#9).
- see subclause 7.5 (Risks arising from risk control measures) of ANSI AAMI ISO 14971:2019 listed below (#9).
Relevant FDA Guidance and/or Supportive Publications*
Relevant guidance:

1. Design Considerations and Pre-market Submission Recommendations for Interoperable Medical Devices - Guidance for Industry and Food and Drug Administration Staff, issued September 2017.

2. Guidance for Industry and FDA Staff - Guidance for the Content of Premarket Submissions for Software Contained in Medical Devices, issued May 2005.

3. Off-The-Shelf Software Use in Medical Devices - Guidance for Industry and Food and Drug Administration Staff, issued September 2019.

4. Medical Device Data Systems, Medical Image Storage Devices, and Medical Image Communications Devices - Guidance for Industry and Food and Drug Administration Staff, issued September 2019.

5. Content of Premarket Submissions for Management of Cybersecurity in Medical Devices - Guidance for Industry and Food and Drug Administration Staff, issued October 2014.

6. Guidance for Industry - Cybersecurity for Networked Medical Devices Containing Off-the-Shelf (OTS) Software, issued January 2005.

7. Postmarket Management of Cybersecurity in Medical Devices - Guidance for Industry and Food and Drug Administration Staff, issued December 2016.

8. AAMI TIR 57:2016 - Principles for medical device security - Risk management.

9. ANSI AAMI ISO 14971:2019 - Medical devices - Applications of risk management to medical devices.
FDA Technical Contact
 Maria Isabel Tejero Del Rio
  FDA/OC/CDRH/OPEQ/OHTIII/
  301-796-5322
  Isabel.Tejero@fda.hhs.gov
Standards Development Organization
IEEE Institute of Electrical and Electronic Engineers https://www.ieee.org/
FDA Specialty Task Group (STG)
Software/Informatics
*These are provided as examples and others may be applicable.
-
-