Michelle Jump, Chief Executive Officer
Chuck Farlow, Senior Director, Program Management and Regulatory Policy
It wouldn’t be efficient to build your own car from scratch, and you would never expect your car to run indefinitely without regular maintenance and attention. Your medical device cybersecurity program needs nurturing, too. Cybersecurity is not a one-time fix but an ongoing and complex process that requires careful design and planning, specialized expertise, and long-term commitment. Creating a credible, sustainable program is a lot of work, but you don’t have to do it alone.
Care and Maintenance of a Medical Device Cybersecurity Program
It’s hard to get a good medical device cybersecurity program up and running. It’s even harder to sustain it. The threat landscape for medical devices is constantly evolving, and so are industry best practices, regulatory requirements, and customer expectations. Keeping up with it all, and implementing appropriate responses, requires considerable time and expertise.
If you ignore the maintenance reminders and “check engine” lights on your car, you can expect that sooner or later, you’ll find yourself at the side of the road with a big repair bill, or worse. Preventive maintenance and prompt attention to emerging problems are always cheaper in the long run than waiting for a catastrophic failure.
The same is true for medical device cybersecurity. Even a well-thought-out security management program will become obsolete over time if it is not continually updated and reviewed, leaving companies vulnerable to new and emerging threats. Just like car repairs, emergency response for a security failure is usually a large unbudgeted expense. A security incident leading to patient harm or loss of patient data may result in legal exposure, costly fines, lost sales, and reputational damage. Even if an incident is avoided, companies must respond immediately if a serious vulnerability comes to light, whether they are prepared or not. Regulators and hospitals know this, too, which is why the pressure has been on for medical device manufacturers to up their game when it comes to postmarket security procedures.
Staying on top of security program maintenance is much cheaper than responding to a security failure. A proactive approach can minimize risks and exposures for medical device companies and reduce the chances of unwelcome surprises. It will also ensure that companies are prepared to respond quickly and effectively when security issues do emerge.
An Ounce of Prevention
That’s why medical device companies need a preventive maintenance plan for cybersecurity. Just like changing the oil and filters will keep your car running trouble-free for longer, a preventive cybersecurity program will reduce costs and risks for medical device companies over the long haul. A good cybersecurity maintenance program will include
proactive monitoring of relevant regulatory expectations and standards applicable to the device’s life cycle,
a plan for ongoing maintenance of your product security program to reflect changing regulatory expectations,
for fielded devices, a plan for cyber hygiene integrated with security risk management and ongoing software maintenance activities,
continual scanning of the security landscape for cybersecurity signals, including new threats and third-party software vulnerabilities, and
plans for incident response and coordinated vulnerability disclosure.
Fighting Decision Paralysis for Security Planning and Response
The complex nature of medical device cybersecurity can result in “decision paralysis” when it comes to security planning and response. Regulatory expectations are changing faster than regulatory guidance, creating a lag where companies have to make critical decisions based on their best judgment but without formal guidance from regulators. Furthermore, the security landscape is always changing, with new technologies, emerging threats, discovered vulnerabilities, and evolving best practices. Even when the information is available, it’s not always easy to determine the best way forward.
This makes proactive management of cybersecurity a heavy lift for most medical device companies. Many companies find it challenging to hire enough security experts. As a result, product security teams tend to be stretched thin. Security staff often find themselves in a reactive mode, jumping from crisis to crisis, without the time to invest in developing and managing preventive maintenance activities.
That’s where having an expert at your side can help. Most of us don’t maintain our own cars, even if we know how. It’s easier to let the experts handle it. Engaging with the right security partner can help medical device companies stay on top of relevant information and make better, more confident decisions for device security and response planning.
A Preventive Maintenance Plan for Cybersecurity
There’s no need to go it alone. Working with seasoned third-party medical device security experts can help you keep your cybersecurity program on track and avoid costly mistakes. And it’s generally much more affordable than hiring more full-time security staff in-house.
That’s why we developed the MedSec Partner Program. This program is like a preventive maintenance plan for your cybersecurity program. It offers a relationship with a trusted partner who understands your business and can help you make sense of how emerging regulatory changes or security threats will impact your product lines. You also have a support system to help you make good decisions and assist with strategic planning. The MedSec Partner Program also provides quarterly strategy updates to ensure your teams are kept up-to-date on the most important new developments.
Remember: maintenance is always cheaper than repair. You don’t want to wait for a catastrophic security failure or a submission delay before putting a plan in place. A preventive maintenance approach will keep your security programs in top condition, so you’re ready for whatever is coming down the road. We’d love to talk with you more about this program. Connect with us to learn more.
About Michelle
As MedSec's CEO, Michelle is responsible for providing strategic leadership, training and education to the medical device industry, and thought leadership in the area of medical device cybersecurity practices and process. She also participates in a variety of domestic and international standards, as well as relevant industry and governmental initiatives to support security within the healthcare industry.
About Chuck
Chuck is a CISSP with more than 36 years of experience with an extensive background in systems engineering, cybersecurity, medical device regulations, and international standards. Chuck works with MedSec senior leadership to develop effective strategies for programs and policy. He currently serves in several AAMI and ISO working groups.
About MedSec
MedSec is uniquely prepared to meet the specific challenges of medical device and healthcare cybersecurity. MedSec partners with medical device manufacturers and healthcare delivery organizations to address cybersecurity in medical devices throughout all stages of the device lifecycle. MedSec leverages its cybersecurity expertise, coupled with its intimate knowledge of the healthcare regulatory and operating environments, to offer support in design, architecture, verification, penetration testing, risk assessments, regulatory filings and SBOM development.