The security risk management report summarizes the whole security process: threat model, security risk assessment, controls, testing and residual risk. Cybersecurity labeling tells the customer which interfaces exist, what security tasks they own, how updates arrive and what to do after a suspected incident. Each cybersecurity document is then attached to its eSTAR slot so the reviewer finds every item FDA lists.
On the map: Security risk management report. Cybersecurity labeling. Map documents to eSTAR slots.
Rows are disciplines, columns are stages 1 to 8. Select a square to open that task.
Back to the full map
Hand regulatory a document map that matches the eSTAR cybersecurity slots. Check the labeling's security instructions with engineering against what the software actually does.
FDA's eSTAR asks for a separate, parallel and interconnected security risk process. Security risks are kept in their own assessment. Those that could harm a patient are traced into the ISO 14971 safety file.
An exploitability scale replaces probability of failure, because an attacker chooses the sequence of events. It is combined with a security-impact severity scale in a documented acceptability matrix. CVSS helps rate single vulnerabilities but is too generic to serve as the whole method. Every pre- and post-control rating is justified.
The content follows FDA's labeling list: all interfaces and protocols, customer security responsibilities, update instructions, how the SBOM is made available, events the device can detect, and the incident response steps. For on-premise software the hospital IT tasks need the most detail.
The current eSTAR template lists the expected items, from the security risk management report to the cybersecurity management plan. Each slot gets one document with stable IDs. A platform with several algorithms usually gets one integrated package with algorithm-specific deltas.
See the open positions and apply.