CISA SBOM updates and medical device security mandates

Regulatory alignment for cyber devices

The FDA requires medical device manufacturers to provide a Software Bill of Materials for all cyber devices under Section 524B of the Federal Food, Drug, and Cosmetic Act. A cyber device includes any product containing software that the sponsor validated, installed, or authorized that can connect to the internet or possesses technological characteristics vulnerable to cybersecurity threats. CISA updated the Minimum Elements for a Software Bill of Materials to include component hash, license, tool name, and generation context. This update builds on the 2021 NTIA baseline to match current software documentation capabilities. The FDA expects manufacturers to provide a machine-readable SBOM that matches the minimum elements identified in the NTIA’s Framing Software Component Transparency document to provide transparency into the software supply chain of all software components. You should know that the FDA uses "should" language to indicate strong recommendations for premarket submissions rather than legally binding regulations. The FDA’s Select Updates guidance for premarket submissions, released in March 2024, clarifies several areas regarding the requirements for providing a Software Bill of Materials for medical devices. Manufacturers must document the software title, manufacturer, version level, release date, and patch number. This information helps organizations manage risk and improve software security by illuminating the software supply chain with data about software ingredients. If a manufacturer treats software security as an afterthought, the FDA may issue "Refuse to Accept" decisions to delay the submission process.

Medtronic vulnerabilities and patching risks

Medtronic reported a critical vulnerability in its Paceart Optima cardiac device data storage system, identified as CVE-2023-31222. Threat actors can use this flaw to modify, delete, or exfiltrate cardiac device data, or execute remote code and launch denial-of-service attacks. This flaw can also impact hospital workflows by enabling patient data encryption and extortion activities. Phosphorus Vice President Sonu Shankar and GuidePoint Security Consultant Christopher Warner emphasized the severity of this vulnerability for both cardiac devices and hospital workflows. This vulnerability highlights the risk of using third-party software components that manufacturers cannot easily update or replace. Research shows that 14% of connected medical devices run on unsupported or end-of-life operating systems. To patch a medical device involves significant risk because a change in the software environment might invalidate the original testing and regulatory clearance. A device might need to undergo retesting in its entirety if the software configuration changes. Identifying a vulnerability in a software component is the easy part, and fixing it without creating another problem remains where the process gets complicated. How can manufacturers maintain a secure environment when a vulnerability is discovered in a component that is not actively used but remains in the software stack?

Lifecycle management and procurement

Healthcare organizations use SBOMs to manage risk throughout the entire product lifecycle. Statistics show that 78% of healthcare organizations view SBOM availability as a factor when selecting vendors. Additionally, 73% of these organizations report that FDA cybersecurity requirements and EU regulations influence their procurement decisions. Manufacturers must provide information regarding support levels and end-of-support dates for all software components.

The FDA expects manufacturers to provide five core pillars of documentation in their submissions. These include a cybersecurity risk management program, the SBOM, a plan for updates and patches, coordinated vulnerability disclosure, and post-market surveillance. Manufacturers must also identify software components with vulnerabilities, including those in the CISA Known Exploited Vulnerabilities catalog. This requirement helps prevent the 0.04 percent increase in mortality rates observed for patients in facilities with a historic breach. The rate of medical device advisories increased by 490% since the release of the FDA Postmarket Cybersecurity Guidance in 2016. Manufacturers must disclose any software modifications or updates that impact cybersecurity, including patching procedures, component replacements, or license changes. With approximately 9,000,000 devices in U.S. hospitals, manufacturers must prepare a traceability matrix that ties a specific security function to the precise risk identified in the hazard analysis.