IT Security & Cybersecurity for medical devices

Since the MDR, cybersecurity for connected medical devices is no longer optional but a general safety and performance requirement. Annex I requires software to be developed according to the state of the art, including information security, and minimum requirements for IT security and protection against unauthorised access to be set out. Guidance document MDCG 2019-16 makes this concrete; IEC 81001-5-1 describes the secure development process.

In the United States the rules are stricter still. For devices with software that can connect to the internet, the FDA has since 2023 required a software bill of materials, a plan for handling vulnerabilities after market release and evidence that the device and related systems are secured to accompany the submission. Without these documents, the submission is not accepted.

The providers listed here cover different parts: threat modelling and security architecture during development, penetration testing of devices and interfaces, software bills of materials and vulnerability monitoring, and securing the company's own IT, for example under ISO 27001 or the requirements of the NIS 2 Directive. Device and corporate network are two different tasks that are often confused.