CDSCO Medical Device Cybersecurity Audit follows draft guidance on Medical Device Software integrates cybersecurity as a core requirement under MDR-2017, referencing standards like IEC 81001-5-1 for robust protection. As a CERT-In empanelled organization, Certcube Labs Pvt Ltd delivers specialized audits to ensure adherence. This blog explores the framework, audit processes, and practical implementation.
Introduction to CDSCO Framework
Medical Device Software falls under two categories: Software in a Medical Device (SiMD) and Software as a Medical Device (SaMD), both regulated by the Medical Devices Rules (MDR), 2017. The Central Drugs Standard Control Organization (CDSCO) mandates cybersecurity to safeguard patient data and device integrity amid rising threats. Applications submit via SUGAM portal, with licensing by Central or State Licensing Authorities based on class.
Cybersecurity addresses vulnerabilities in software lifecycle, from design to post-market surveillance. The guidance emphasizes state-of-the-art practices, including IT/network security and vulnerability monitoring. Non-compliance risks license denial or recalls, impacting market access.
Types of Medical Device Software
SiMD embeds in hardware like pacemakers or insulin pumps, controlling functions without standalone medical purpose. SaMD operates independently on general platforms, performing diagnosis or treatment, such as AI image analysis tools. Examples include CAD software for X-rays or cell count apps.
Software excluding medical purposes—like data storage or hospital info systems—escapes regulation. Intended use statements detail purpose, population, and outputs, crucial for classification. IVD SaMD specifies analytes and sample types.
Risk Classification and Cybersecurity
Devices classify A-D by risk, with software matching hardware or standalone assessment per First Schedule. SaMD uses a matrix: critical conditions with treatment/diagnosis yield Class D; non-serious informing management is Class A. Cybersecurity elevates risk if vulnerabilities threaten life.
Factors include significance (treatment vs. inform) and condition severity (critical/serious/non-serious). CDSCO publishes classified lists, dynamic per reviews. Audits verify controls prevent unauthorized access, per IEC 81001-5-1.
Applicable Standards for Cybersecurity
Key standards: ISO 13485 (QMS), ISO 14971 (risk management), IEC 62304 (lifecycle), and IEC 81001-5-1 (cybersecurity). Others cover AI risks (ISO/IEC 23894) and ergonomics (IEC 62366-1). Manufacturers validate against BIS, ISO/IEC, or internal standards.
Cybersecurity mandates secure coding, encryption, authentication, and patch mechanisms. Defense-in-depth and secure-by-design integrate from inception. Post-market includes vulnerability monitoring.
Quality Management System Requirements
QMS spans lifecycle: design, deployment, maintenance per Fifth Schedule. Indigenous firms declare compliance; importers provide QMS certificates. Audits assess organizational structure and records.
Cybersecurity embeds in QMS via risk controls validation and network security. IEC/TR 80002 series guides application. Certcube Labs audits QMS for MDR alignment, focusing on cybersecurity gaps.
Licensing and Submission Pathways
Test licenses for trials via NSWS; others via CDSCO online. Class A (non-sterile) exempts licensing but requires registration; higher classes need CLA/SLA approval. Documents: intended use, risk analysis, clinical evidence, standards conformity.
For imports/manufacturing: technical dossiers include cybersecurity plans. Timelines per MDR; post-approval needs PMS, PSURs. IVD follows similar paths with performance evaluation.
Cybersecurity in Pre-Market Audit
Audits verify secure development, threat modeling, and controls like access restrictions. Key checks: vulnerability scans, penetration testing, secure updates. Documentation proves no compromise from patches.
Intended use influences: high-risk SaMD demands rigorous controls. Certcube Labs conducts these as CERT-In empanelled, ensuring MDR/CDSCO fit. Reference IEC 81001-5-1 for health software security.
Documents for Compliance Audit
- Risk management file (ISO 14971).
- Software lifecycle processes (IEC 62304).
- Cybersecurity assessment per IEC 81001-5-1.
- Clinical evidence/validation reports.
- QMS undertaking/certificate.
Auditors review for PMS plans covering cyber threats. Certcube Labs tailors checklists for CDSCO submissions.
Clinical Investigation and Permissions
Investigational software needs CLA permission pre-trials. Documents mirror licensing, plus ethics approval. Cybersecurity ensures trial data integrity. Audits confirm secure handling of SUSARs.
New IVD requires performance evaluation.
Post-Market Surveillance and Audits
PMS monitors vulnerabilities, incidents via PSUR/FSCA. Report AEs, cyber breaches promptly. Audits validate ongoing controls, updates.
Certcube Labs performs PMS audits, leveraging CERT-In expertise for threat detection.
Role of Certcube Labs Pvt Ltd
As CERT-In empanelled, Certcube Labs audits IT/cyber frameworks for regulated sectors. Services: vulnerability assessments, penetration testing, compliance gap analysis per CDSCO/IEC standards.
For medical devices, they cover QMS, risk classification, lifecycle security. Empanelment ensures credibility for CDSCO-aligned reports. Clients gain audit-ready dossiers, reducing approval timelines.
Audit Process by Certcube Labs
- Gap assessment against CDSCO/IEC.
- Penetration testing, code reviews.
- Risk remediation roadmap.
- Certification/report for licensing.
Tailored for SaMD/SiMD, focusing on connected devices.
Best Practices for Compliance
- Adopt secure-by-design.
- Regular pentests, updates.
- Train on threats.
- Document everything.