Cybersecurity plays a central role in medical device registration in China. This article walks through the structure of the cybersecurity research report required by China’s National Medical Products Administration (NMPA).
1. Basic information
- Software information: the basic characteristics of the software and its software safety level.
- Data architecture: the network environment and data flow diagram for each use scenario, and a description of the device-related data and electronic interfaces.
- Cybersecurity capabilities: the cybersecurity capabilities of the device.
- Cybersecurity patches: basic information on cybersecurity patches.
- Security software: basic information on security software.
2. Implementation process
- Risk management: cybersecurity risk analysis report and risk management report.
- Requirements specification: cybersecurity requirements specification.
- Verification and validation: cybersecurity test plan and report.
- Traceability analysis: cybersecurity traceability analysis report.
- Maintenance plan: flowcharts and descriptions of activities for cybersecurity updates, incident response, and remote maintenance and upgrades.
3. Vulnerability assessment
| Software safety level | Requirements |
|---|---|
| Minor | State the total number of known vulnerabilities and the number of remaining vulnerabilities by severity. |
| Moderate | Provide a cybersecurity vulnerability self-assessment report stating the total number of known vulnerabilities and the remaining known vulnerabilities by severity. |
| Major | Provide a vulnerability self-assessment report and a vulnerability assessment report issued by a cybersecurity assessment body, and describe the maintenance plan for remaining known vulnerabilities. |
4. Conclusion
Give a comprehensive overview of how well-controlled the cybersecurity implementation process is and, together with the vulnerability assessment results, conclude whether the product’s cybersecurity meets the requirements.
How EVERBIZ can help
EVERBIZ supports manufacturers in preparing cybersecurity research reports and documentation for NMPA registration. Contact us.
This article is for general information only and does not constitute legal advice. The current NMPA guideline is authoritative.