Henry: AAMI TIR97 (Principles for medical device security—Postmarket risk management for device manufacturers) mentions legacy devices only in an appendix in the context of applying risk assessments for legacy devices not beyond end-of service. The newly released AAMI SW96 also mentions legacy systems in an appendix encouraging threat modeling for these systems even if one was not done when the system was developed. FDA guidance does not currently address legacy devices, and my own experience in seeing how the agency responds to insecure legacy devices reflects an expectation that firms either deploy clear and effective compensating controls or consider something akin to a repair/replace program. I also see potential issues with an FDA guidance providing significant recommendations to HCPs, given their limited authority over them. Any incorporation of the IMDRF guidance may require some level of interagency collaboration.

Q&A: IMDRF Releases Final Legacy Device Cybersecurity Guidance

More from International

More from Geography