Skip to main content
    Back to episode
    Episode 69 · August 5, 2025 · 23m listen · 4,144 words · ~21 min read

    Understanding Cybersecurity Measures and Metrics for Medical Devices | Ep. 31 - Full Transcript | The Med Device Cyber Podcast

    Read the complete, searchable transcript of Episode 69 of The Med Device Cyber Podcast - expert conversations on medical device cybersecurity, FDA premarket and postmarket guidance, SBOM management, threat modeling, and penetration testing.

    Prefer the listening experience? Open the episode page for the synopsis, key takeaways, topics, and Apple / YouTube listen links.

    Episode summary

    This episode of The Med Device Cyber Podcast delves into the crucial distinctions between cybersecurity measures and metrics for medical devices, a topic often misunderstood yet vital for FDA submissions. Hosts Christian Espinosa and Trevor Slatterie clarify that measures are quantifiable attributes (e.g., time to patch), while metrics are derived calculations (e.g., percentage of systems patched within a timeframe). The discussion highlights the FDA's specific requirements in 510(k) and PMA submissions, focusing on vulnerability management, patch availability, and deployment durations. The hosts emphasize the importance of a risk-based approach to vulnerability remediation, aligning timelines with device architecture and potential impact on patient safety. They explore strategies for detecting incidents, designing effective alerting mechanisms, and the significance of a robust postmarket surveillance plan. The episode also touches on the applicability of these measures and metrics across different device lifecycle stages and environments, providing valuable insights for product security teams, regulatory leads, and engineers navigating the complexities of medical device cybersecurity compliance and beyond.

    Key takeaways from this episode

    • Measures are quantifiable attributes like the time taken to apply a patch or the number of incidents, while metrics are calculations derived from these measures, often expressed as percentages, such as patch management efficiency.
    • The FDA is specifically interested in measuring the percentage of identified vulnerabilities that are updated or patched, the duration from vulnerability identification to patch availability, and the duration from patch availability to deployment across all fielded products.
    • A risk-based approach is crucial for vulnerability remediation, prioritizing critical vulnerabilities for faster patching while considering the device's architecture and the feasibility of over-the-air updates versus manual service technician deployments.
    • Implementing effective alerting mechanisms directly into medical devices can compensate for the lack of real-time monitoring by traditional SOCs, notifying users of security events and guiding them on how to report anomalies to the manufacturer.
    • While the FDA outlines minimum cybersecurity measures and metrics, manufacturers should strive to exceed these baselines to demonstrate a serious commitment to product security throughout the device's lifecycle and across various deployment environments.
    • Understanding the applicability of these measures and metrics is essential, as new devices without predicate data may only need a plan for collection, while established devices or PMA annual reports require actual data.
    • Beyond compliance, the ability to translate collected measures and metrics into actionable plans for risk reduction is paramount for effective medical device cybersecurity.

    Full episode transcript

    Page 1 of 5· Paragraphs 1 - 11
    Hi, welcome back to The Med Device Cyber Podcast. Today we're going to talk about measures and metrics, a commonly misunderstood topic. Measures are different than metrics, and the FDA is looking for very specific things in a 510k or PMA submission. We'll cover these in enough detail so you can have a decent understanding of them. I'm Christian Espinosa, your co-host here with Trevor Slatterie. How are you doing today, Trevor? Doing good. Getting some nice weather right now. Are you in Sedona? I am in Sedona. Yeah. You know, I did use AI once to create a snippet of one of our podcasts, and it mentioned the guy with the bull in the background. It referenced you as that, and that's where you are. I see the bull picture in the background. Is it a bull or what is that? I think it's a yak or a bull. Something like that. Yeah, it's funny. The AI referred to you as the young man with the bull in the background or something like that. There you go. Cool. All right. So, I think it's important to start with the definition of a measure and then the definition of a metric. A measure is just like a tape measure, right? It's like a quantifiable attribute of something, like how long does it take to apply a patch? How many incidents occurred? That's a measure. Whereas a metric is some sort of calculation derived from a couple of measures, typically usually a percentage. Do you have anything to elaborate on those two? Yeah, so essentially what we're saying is that the metrics are derived from measures, and so they go hand in hand, but they are distinct, separate items. Yeah. So, an example would be a measure: how long does it take to apply a patch? A metric could be your patch management efficiency: the percentage of systems patched within a defined time. So that's a percentage, the metric, versus the duration, which is the measure. Spoiler for what we're going to talk about when we say what the FDA wants to see. That's a spoiler. We'll get there in a few minutes, I'm sure. All right. So now that we understand a measure versus a metric, what does the FDA want to see in terms of measures? We'll start with measures first. Well, I think before we get into the specific measures and metrics, we should talk about how the FDA wants to see us collect the figures that go into this. So, the measures and metrics are these quantifiable figures: how long does it take to apply a patch? How many vulnerabilities are we remediating? And they want to see, now that we're understanding these different measures and metrics, how are we getting the information to provide this? And so the first thing, when we're looking at the required FDA documentation, they combine the total product life cycle considerations into the measures and metrics when you're looking at the headings throughout FDA guidance and through the eSTAR submission process. And so the first area that the FDA wants to see you cover is how you are identifying, addressing, and mitigating vulnerabilities, which it's essentially three separate and comprehensive questions, but it should talk about your vulnerability management process, any tools, any processes that you're using for collecting these vulnerabilities, and then how you're tracking it once you've identified them. Well, I think the measures that go with that are once you've identified a vulnerability and you've verified it actually is a real vulnerability, what's the risk associated with it? And then if the risk is critical, how quickly should that be patched versus if the risk is low, as an example, that duration would be a measure. Right? Yeah. Yeah. And that feeds directly into, we can, well, we can talk about what the measures and metrics are and then work backwards from how we get to these figures. So, the FDA wants to see as one of the first points what your percentage of identified vulnerabilities that are updated or patched is. And so, especially with a complicated device, you can get hundreds, if not thousands, of vulnerabilities at a single time. And so seeing these come in, how are you triaging them based on severity? Like you mentioned, it's going to be more important to handle these critical vulnerabilities as opposed to these low vulnerabilities. What is your timeline for remediation in just general patch cycles? And so if you're following sprints, which a lot of engineers and manufacturers like to follow that development cycle, what are your sprint cycles looking like? How many vulnerabilities are you remediating per sprint cycle? You should be looking at close to 100% of critical vulnerabilities as possible, and then you can start tapering off as you go down lower in risk. So, what are the typical measures then for what you just talked about? Because this comes up quite often if I have identified a high-risk item or critical risk item. What are the typical timelines that should be applied to get that patch rolled out?
    1 / 5