ANSI UL Medical Device Cybersecurity Standard Receives Official US FDA Recognition
Questions? Request more information from our specialists
CONTACT USJun 26, 2018
EMERGO SUMMARY OF KEY POINTS:
- US FDA has officially recognized a new consensus standard, ANSI UL 2900-2-1, for assessing network-connected medical device cybersecurity risk.
- US medical device market applicants may now utilize ANSI UL 2900-2-1 to demonstrate safety of their network-connected devices, accessories and software.
- FDA recognized a related standard, UL 2900-1 Ed. 2017, last year.
The US Food and Drug Administration has officially recognized a standard from the American National Standards Institute (ANSI) and UL targeting medical device cybersecurity.
FDA’s recognition of ANSI UL 2900-2-1—Standard for Safety, Software Cybersecurity for Network-Connectable Products, Part 2-1: Particular Requirements for Network Connectable Components of Healthcare and Wellness Systems as an official consensus standard now appears in the US Federal Register.
Using ANSI UL 2900-2-1 to address FDA cybersecurity requirements
As FDA 510(k) premarket notification and other medical device premarket submissions must now include data showing US market applicants’ efforts to mitigate cybersecurity risks and vulnerabilities, companies may utilize ANSI UL 2900-2-1 to demonstrate the safety of their network-connectable devices and accessories.
The ANSI UL 2900-2-1 consensus standard was developed to provide manufacturers as well as regulators with a consistent framework for cybersecurity risk assessment; the standard applies to all medical devices and accessories, as well as IVD devices, device data systems and health information technology products.
In summer 2017, FDA recognized a related standard, UL 2900-1 Ed. 2017—Standard for Software Security Network-Connectable Products, Part 1: General Requirements, which includes evaluations and assessments of network-connectable devices’ cybersecurity vulnerabilities.
Additional US FDA and medical device cybersecurity resources:
- US FDA 510(k) consulting for medical device and IVD manufacturers
- Cybersecurity testing for network-connected medical devices and software
- Regulatory consulting for digital health and mobile medical apps
Author
- Stewart Eisenhart
Related
FDA Adds UL 2900 for Medical Device Cybersecurity to List of Recognized Standards
EMERGO SUMMARY OF KEY POINTS:
- The US FDA has now officially recognized the UL 2900 cybersecurity standard for medical devices.
- UL 2900-1 covers general cybersecurity requirements for network-connectable devices.
- FDA medical device applicants may now declare conformity to UL 2900-1 in order to address cybersecurity requirements as part of their US market registration.
UL 2900 Cybersecurity Standards Set for FDA Adoption
EMERGO SUMMARY OF KEY POINTS:
- A medical device and healthcare networking cybersecurity standard from UL is being recognized by the US Food and Drug Administration.
- The UL 2900 set of standards will enable US medical device market registrants to assemble evidence to demonstrate proper cybersecurity features for their products.
- Tools to demonstrate compliance with FDA cybersecurity requirements should help device manufacturers and medical software developers in both pre- and post-market environments.