FDA’s medical device cybersecurity deal deemed outdated, watchdog discloses

The Government Accountability Office (GAO) has found that the cybersecurity agreement between the Food and Drug Administration (FDA) and the Cybersecurity and Infrastructure Security Agency (CISA) needs to be updated. The agreement, which focuses on cybersecurity protocols for medical devices, is five years old and does not reflect recent organizational and procedural changes. While medical device vulnerabilities have not been frequent sources of cyber exploits, the FDA still considers them a significant concern for hospital cybersecurity. The GAO report also highlighted that the FDA’s authority over medical device cybersecurity has increased, due to legislation mandating that manufacturers submit plans to identify and address vulnerabilities. The report recommends that the FDA and CISA update their agreement to reflect these changes, a recommendation that both agencies agree with.