FDA医疗器械网络安全指导文件重点汇总
📅 2024年06月12日
📂 注册解析
✍️ Grzan
随着无线、互联网和网络连接能力、便携式媒体(如USB或CD)的日益集成，以及医疗器械相关健康信息和其他信息的频繁电子交换，需要强有力的网络安全控制来确保医疗器械的安全和有效性变得更加重要。
FDA近些年对网络安全问题愈发重视，下面我们整理了FDA关于网络安全上市前提交内容方面的相关指南，汇总如下（发布顺序不分先后）：
| 分类 | 文件名称 | 内容 |
| FDA指南 | Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions | FDA关于医疗器械软件网络安全的总体要求指南 |
| Postmarket Management of Cybersecurity in Medical Devices | FDA关于已上市医疗器械网络安全的要求和指南 | |
| Select Updates for the Premarket Cybersecurity Guidance Section 524B of the FD&C Act | 针对《Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions》提出的补充指南 | |
| Cybersecurity for Networked Medical Devices Containing Off-the-Shelf (OTS) Software | 该指南为包含现成软件(OTS)可连接到私有内部网或公共互联网的医疗设备提供的建议。 | |
| FDA关于网络安全的网络研讨会 | Draft Guidance ‐ Select Updates for the Premarket Cybersecurity Guidance Section 524B of the FD&C Act–PPT | 对《Select Updates for the Premarket Cybersecurity Guidance: Section 524B of the FD&C Act》解读的PPT |
| Draft Guidance ‐ Select Updates for the Premarket Cybersecurity Guidance Section 524B of the FD&C Act–PPT—Transcript | 《Select Updates for the Premarket Cybersecurity Guidance: Section 524B of the FD&C Act》解读PPT的问答记录及其内容 | |
| Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions-PPT | 对《Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submission》解读的PPT | |
| Cybersecurity in Medical Devices Quality System Considerations and Content of Premarket Submissions-PPT—Transcript | 《Cybersecurity in Medical Devices Quality System Considerations and Content of Premarket Submissions》解读PPT的问答记录及其内容 | |
| 指导手册 | Best Practices for Communicating Cybersecurity Vulnerabilities to Patients | 为提供针对设计网络安全漏洞时的考虑 |
| Framing Software Component Transparency: Establishing a Common Software Bill of Material (SBOM) | 为构建软件物料清单提供指导 | |
| PLAYBOOK FOR THREAT MODELING MEDICAL DEVICES | 为完善医疗器械的威胁建模文档提供指导 | |
| Medical Device and Health IT Joint Security Plan （JSP V2.0） | 用于在医疗保健环境中开发、部署和支持网络安全技术解决方案 | |
| MANUFACTURER DISCLOSURE STATEMENT FOR MEDICAL DEVICE SECURITY（MDS2） | 医疗器械制造商用来向医疗保健服务组织传达关键安全相关信息的自愿性文件 | |
| 相关标准 | AAMI TIR57：2016/(R)2023 Principles for medical device security-Risk management | 关于医疗器械IT安全风险分析提供的公认的工作流程框架 |
| ANSI ISA 62443-4-：2018 Security for industrial automation and control systemsPart 4-1: Product security development life-cycle requirements | IEC发布的关于从根本上减少工控网络安全风险的发生，降低工控网络安全风险的影响 | |
| IEC 81001-5-1：2021 Health software and health IT systems safety, effectiveness and security -Part 5-1:Security-Activities in the product life cycle | 此标准对IEC 62304的网络安全相关内容进行了补充 | |
| IEC TR 80001-2-2：2012 Application of risk management for iT-networks incorporating medical devices -Part 2-2: Guidance for the disclosure and communication of medical device security needs. risks and controls | 此标准规范了十九项网络安全能力，可以根据医疗器械的产品特性考虑其网络安全能力要求的适用性 | |
| IEC TR 80001-2-8：2015 Application of risk management for IT-networks incorporating medical devices Part 2-8: Application guidance-Guidance on standards for establishing the security capabilities identified in lEC TR 80001-2-2 | 提供了如何应用IEC TR 80001-2-2(2012)中概述的框架的指南 | |
| IEC TR 80001-2-9：2017 Application of risk management for it-networks incorporating medical devices -Part 2-9: Application guidance-Guidance for use of security assurance cases to demonstrate confidence in lEC TR 80001-2-2 security capabilities | 提供识别、开发、解释、更新和维护联网医疗设备的安全保证案例，还为选择 IEC TR 80001-2-2(2012)中列出安全控制以建立安全能力提供了指导 |
声明：如本文与FDA或标准官网发布的信息不一致，请以官网发布的信息为准。
如果需要可以联系国瑞小编提供原文清单和指南链接。
