Security testing shows that the cybersecurity controls work on the build that will be submitted. It covers verification of the security requirements and threat mitigations, vulnerability testing such as SBOM scanning, static analysis and fuzzing of the external interfaces, and a penetration test by testers who did not build the device. Every finding is dispositioned and the results go into a vulnerability report and a security testing report.
On the map: Independent pen and fuzz testing. Vulnerability report. Security testing report.
Rows are disciplines, columns are stages 1 to 8. Select a square to open that task.
Back to the full map
Pen-test the build that engineering verifies, and give quality the findings as anomalies with dispositions. Ask regulatory early whether FDA will expect an independent tester for this device.
Scope follows the attack surface in the security architecture views. Each interface that accepts outside data is listed (DICOM receiver, API, update path, removable media), along with the test target, test accounts and the level of tester knowledge. Most cyber devices get a pen test. Skipping it is only defensible for a very small attack surface, and FDA may still ask for one.
FDA expects the report to state who tested and how independent they are from the developers. An outside firm is the usual choice. An internal tester is acceptable only if they had no part in development and hold pen-test credentials. The original third-party report goes into the submission.
Fuzz the external interfaces that parse untrusted input, such as image receivers and file parsers. UL 2900-1 gives a benchmark of 1,000,000 test cases or 8 hours per protocol. If the pen tester fuzzed, the report should name the interfaces, the duration and the input count so the work can be credited.
Each finding is fixed, accepted with an exploitability and residual-risk rationale, or shown not reproducible. Fixes are retested on the same production-representative build. Accepted findings go into the security risk assessment and the unresolved anomalies list. Testing is done on the final build and kept within about a year of submission.
See the open positions and apply.