What is happening
The FDA has reportedly asked manufacturers to include a list of known vulnerabilities alongside their software component inventory during regulatory approval, though it is not yet in formal guidance. Known vulnerabilities in a software product are common and not automatically disqualifying. While vulnerability tracking is a required part of the postmarket plan and activity, it has not commonly been requested in premarket submissions with this level of detail or specific format.
What it means in practice
During a regulatory review, you may be asked to provide a machine-readable Vulnerability Exploitability eXchange (VEX) document that describes how your device is impacted by known vulnerabilities in third-party and open source components. Many open source and commercial tools (including those you may already be using, such as software composition analysis tools) can cross-match your SBOM with Common Vulnerabilities and Exposures (CVEs) tracked in the NIST National Vulnerability Database (NVD) or other sources. Results from cybersecurity testing (such as penetration testing, vulnerability scanning, static and dynamic analysis, and fuzz testing) may surface additional results to be included.
In future, the FDA may follow up with questions, such as why specific vulnerabilities known to be exploited by adversaries (such as listed in the Known Exploited Vulnerabilities list maintained by CISA) were not found through certain types of cybersecurity testing. Anticipating and preparing for these types of questions in advance may help reduce regulatory cost, timeline, and risk.
What to do now
- Document known vulnerabilities in your product from sources such as SCA tools, vulnerability scanners, penetration testing, and fuzz testing.
- For each finding, identify whether and how your device is affected, determine whether the risk is controlled, and document the outcome using your existing risk assessment processes.
- Catalog the results in a standards-compliant, machine-readable VEX document format, such as CycloneDX.
- Ensure cybersecurity testing plans are sufficient to identify, assess, and track vulnerabilities during premarket, in addition to postmarket.
- Consider including the VEX document in your next regulatory submission to show that you are proactively identifying, assessing, and addressing cybersecurity issues.
Still confused? I don’t blame you. While it’s a lot of cybersecurity jargon, it’s a known practice in other software areas. Get in touch and I’m happy to set up some time to talk it through and make sure you’re prepared.