Getting FDA clearance for your medical device, is all about proving safety and efficacy. In recent years, the safety issue has been expanded heavily to include cybersecurity. Connected devices require rigorous review of their setup to make sure patients (or their privacy) aren’t at risk.

To get a speedy clearance, your entry has to include a strong security dossier. This is what Threat Modeling provides. When we Threat Model, we bring all parties involved (product owner, architect, R&D, developers) to the table to perform a full risk analysis. We completely draw out the design of the system in a Data Flow Diagram. This shows all components and dataflows and it illustrates important ‘trust boundaries’. Using this documentation, we create scenarios that might occur to threaten the safety of the product. We can then look at ways to mitigate those threats and reduce risk.

The result of this exercise is a complete understanding of the ‘cyber safety’ of the medical device. The Threat Model serves as a powerful cybersecurity dossier to support your FDA filing.
This is a living document.
If something changes in the architecture, or an element is added, we review the Threat Model to make sure the right choices are made and the diagrams are amended. This way, the Threat Model is always up-to-date with the current product version.

Siebe De Roovere
Business Unit Director / Principal Consultant