Cyber ​​Security / Software Validation

🔵 Cyber ​​Security

The cybersecurity test is designed to ensure user safety by preventing security threats such as hacking, information leakage, and malfunctions in medical devices used for transmitting and receiving personal medical information or controlling devices.

🔹 Related Applicable Standards

  • ISO 14971 (Application of risk management to medical devices)
  • IEC 62443-3-3 (System security requirements and security levels)
  • IEC 62443-4-1 (Secure product development lifecycle requirements)
  • IEC 62443-4-2 (Technical security requirements for IACS components)
  • IEC 81001-5-1 (Health software and health IT systems safety, effectiveness and security – Part 5-1: Security – Activities in the product lifecycle)
  • IEC TR 60601-4-5 (Medical electrical equipment – Part 4-5: Guidance and interpretation – Safety-related technical security specifications)
  • IEC TR 80002-1 (Medical device software – Part 1: Guidance on the application of ISO 14971 to medical device software)
  • ETSI EN 303 645 (Cyber Security for Consumer Internet of Things: Baseline Requirements)
  • ANSI/AAMI SW96 (Standard For Medical Device Security – Security Risk Management For Device Manufacturers)
  • UL 2900-1 (Software Cybersecurity for Network-Connectable Products, Part 1: General Requirements)
  • EN 18031 (Common security requirements for radio equipment)

🔹 Applicable To

The applicable guidelines apply to medical devices with wired or wireless communication paths (Wi-Fi, Bluetooth, USB, RS-232, LAN, etc.), and fall under the following categories.

  1. Medical devices containing software: Medical devices containing software, such as firmware or programmable logic controllers (PLCs).
  2. SaMD: Software as a Medical Device

🔹CIA TRIAD

In medical device cybersecurity, the CIA Triad must be ensured. This refers to the three essential elements that must be considered in information security.

  1. Confidentiality:
    Data must not be exposed to unauthorized persons or used for unauthorized purposes.
  2. Integrity:
    Data must not be tampered with or destroyed in an unauthorized manner.
  3. Availability:
    Data must be accessible to authorized users when, where, and in the form required.

🔹Key Requirements for Permission and Review

Based on the product’s technical characteristics and usage environment, the following essential security functions must be implemented and verified.

  1. Usage Control (UC): Access authorization, session locking, audit log generation, and timestamps, etc.
  2. Data Protection: Encryption of transmitted and stored data
  3. System integrity: Prevention of unauthorized code execution, countermeasures against malicious software (malware), etc.
  4. Response and Recovery: Maintaining essential safety and performance in the event of security threats, establishing incident response plans

🟠 Software Validation

Medical device software validation is a documentation activity that demonstrates, through objective evidence, that the software continuously and consistently meets its intended purpose and requirements for patient safety.

It is primarily conducted based on the international standard IEC 62304 (Medical Device Software Lifecycle Process), and the required level of verification varies depending on the software grade (Grades A to C).

🔸 Main Contents and Features

  • Applicable To
    • Software embedded in medical devices, standalone medical device software (SaMD), and automation software used for medical device quality system (GMP) management.

  • Key verification steps
    • Software Requirements Analysis Architecture and Detailed Design Unit Test
    • Integration Test
    • System Test
    • Validation

  • Major Outputs
    • Software Development Plan
    • Requirements Specification
    • Architecture Design Document
    • Risk Management Report
    • Configuration Management and Maintenance Documents

🔸 Major Document Records

  • Medical Device / Software Development Plan
  • SRS, Software Requirements Specification
  • Software Architecture Design Chart
  • SDD, Software Design Description
  • SDS, Software Design Specification
  • Software Verification and Validation
  • Includes records of verification and validation activities, actions taken on activity results, unresolved variants, etc.
  • SCM, Software Configuration Management
  • Documentation for users: Software documentation, manuals, guidelines
  • Documentation from the manufacturer: Software maintenance manual
Scroll to Top