The cybersecurity research report is a key document for ensuring the safe operation of networked medical devices and for registration with China’s National Medical Products Administration (NMPA). But how can you tell whether a report is good? Here are the key criteria.
1. Completeness
- Basic information: the report should clearly and accurately state the key information on the device – name, model, specifications, scope of application – as well as the background, purpose and scope of the study.
- Coverage of all cybersecurity aspects: a good report covers the analysis of security properties (confidentiality, integrity, availability), a detailed description of the data (categories, processing flow, security measures), the electronic interfaces and the assessment of cybersecurity capabilities (automatic logoff, audit, authorisation, etc.). If important sections are missing, the report is incomplete.
2. Accuracy and scientific soundness
- Data and facts: data, cases and statements must be accurate and come from reliable sources, which can be checked through the references cited. For example, any statement on the frequency of a type of vulnerability should be supported by authoritative data rather than assumptions.
- Appropriate methods: check whether the methods and tools are scientifically sound and in line with industry practice – for example, whether vulnerability scanning uses suitable professional tools and whether the risk assessment method (qualitative or quantitative) fits the device.
3. Depth and expertise
- Technical depth: key technical aspects should be analysed in depth. When discussing encryption, for instance, it is not enough to name the algorithm – key management and the real-world strength of the algorithm must be addressed. Interface analysis should go down to protocol details and deeper threats.
- Depth of risk assessment: beyond identifying risks, analyse their root causes, potential scope and severity, and classify them with a suitable assessment model.
4. Logical coherence
- Structure: the report should follow a clear order – background, analysis, risk assessment, conclusions and recommendations – with smooth transitions. Logical gaps make the core content hard to follow.
- Clear cause and effect: link problems, risks and countermeasures clearly – for example, state that a particular vulnerability could lead to a specific data leakage risk and propose a targeted fix.
5. What depth looks like in practice
- Security properties: confidentiality – encryption mechanisms and access control strategy; integrity – data verification and tamper protection; availability – fault tolerance and redundancy, backup and recovery.
- Device data: detailed data classification and relationships; tracking of the full data flow with risk identification across use scenarios.
- Electronic interfaces: low-level protocol analysis and interface protection mechanisms; characteristics and data exchange security of non-network interfaces.
- Cybersecurity capabilities: automatic logoff – time policies and trigger conditions; audit – completeness of logging and audit analysis; authorisation – permission models and authentication technologies.
- Risk assessment and management: multi-dimensional risk identification including emerging risks; refined models and dynamic risk assessment; effective, combined control measures with continuous improvement.
Standards to reference
- IEC 80001 series standards and technical reports (e.g. IEC TR 80001-2-2)
- IEC 60601-1 (3rd edition with amendments), in particular the requirements for programmable electrical medical systems and IT networks
- IEC 82304-1 (health software)
- IEC 81001-5-1 (security activities in the health software lifecycle)
- ISO/IEC 27000 series
- ISO 27799 (information security management in health)
How EVERBIZ can help
EVERBIZ reviews and prepares cybersecurity research reports for NMPA registration and cybersecurity documentation for FDA and EU MDR/IVDR submissions. Contact us.
This article is for general information only and does not constitute legal advice.