Cybersecurity is becoming ever more important for medical devices, and the registration requirements of China’s National Medical Products Administration (NMPA) cover several key aspects. This article summarises the main points for the cybersecurity documentation review and product registration.
Review of the cybersecurity documentation
Scope
The NMPA cybersecurity guideline applies to registration applications for class II and class III medical devices with network connectivity for electronic data exchange or remote control:
- Networks include wireless and wired networks.
- Electronic data exchange includes one-way and two-way data transmission.
- Remote control includes real-time and non-real-time control.
- It covers both domestic and imported products, and initial registration, changes to licensed items and renewal of registration.
Protection levels
- Product level: the medical device itself.
- System level: the medical IT network in which it operates.
Key points and capability building
- Maintain the confidentiality, integrity and availability of medical device data.
- Implement user access control; technologies such as encryption, digital signatures, standard protocols and checksums can be used.
- Technologies such as firewalls, intrusion detection and malware protection can be used.
- Build cybersecurity capabilities: devices should be able to identify and protect against cybersecurity threats and have appropriate detection, response and recovery capabilities.
Reference can be made to standards and technical reports such as IEC TR 80001-2-2, which describes 19 security capabilities:
| Code | Security capability |
|---|---|
| ALOF | Automatic logoff |
| AUDT | Audit controls |
| AUTH | Authorisation |
| CNFS | Configuration of security features |
| CSUP | Cyber security product upgrades |
| DIDT | Health data de-identification |
| DTBK | Data backup and disaster recovery |
| EMRG | Emergency access |
| IGAU | Health data integrity and authenticity |
| MLDP | Malware detection/protection |
| NAUT | Node authentication |
| PAUT | Person authentication |
| PLOK | Physical locks |
| RDMP | Third-party components in product lifecycle roadmaps |
| SAHD | System and application hardening |
| SGUD | Security guides |
| STCF | Health data storage confidentiality |
| TXCF | Transmission confidentiality |
| TXIG | Transmission integrity |
Methods of data exchange
- Via networks (wireless or wired) for electronic data exchange or remote control: consider network requirements (interfaces, bandwidth, radio regulation), data transmission protocols (standard or not) and remote control (real-time or not).
- Via storage media (optical discs, external hard drives, USB drives, etc.): consider data storage formats (standard or not).
Cybersecurity of off-the-shelf software
This covers application software – off-the-shelf, legacy and outsourced software – as well as system and support software. For application software, the focus is on how cybersecurity issues affect the clinical use of the device; for system and support software, the focus is on how security patch updates affect the device.
Routine security patch documentation
Contains a description of the update, the test plan and report, and a description of any new known residual defects. It applies to minor cybersecurity updates.
Product registration
- A separate cybersecurity description document must be submitted.
- Product technical requirements must include: data interfaces; transmission protocols/storage formats; user access control, including user authentication methods, user types and permissions.
- Instructions for use must include: the operating environment (hardware configuration, software environment, network conditions); security software (antivirus software, firewalls, updates); user access control mechanisms; and data and device information.
Summary
Cybersecurity is an important part of safety and effectiveness. The NMPA cybersecurity guideline supplements the software guideline, and its scope is slightly narrower than that of the software guideline.
How EVERBIZ can help
EVERBIZ supports manufacturers in preparing cybersecurity documentation for NMPA, FDA and EU MDR/IVDR submissions. Contact us.
This article is for general information only and does not constitute legal advice. The current NMPA guideline is authoritative.