FDA Updates Cybersecurity Playbook

FDA Updates Cybersecurity Playbook

FDA Updates Cybersecurity Playbook for Health Care Organizations

The healthcare sector knows how to prepare for and respond to natural disasters. It is less prepared, however, to handle cybersecurity incidents, particularly those involving medical devices.  With healthcare-related cyber incidents growing in size and scope, preparedness before a cyber event takes place with a strong, well-exercised, support infrastructure in place is foundational to executing a rapid, comprehensive and robust response.  Through planning and practice, as well as support from and collaboration with manufacturers and regional and national partners, HDOs can be well positioned to manage medical device cyber incidents.

As the landscape for health care technology continues to grow and change, the U.S. Food and Drug Administration (FDA) collaborated with MITRE to update the Medical Device Cybersecurity Regional Incident Preparedness and Response Playbook, a resource to help health care delivery organizations prepare for cybersecurity incidents. The playbook focuses on preparedness and response for medical device cybersecurity issues that impact the functionality of a medical device.

The playbook outlines how hospitals and other HDOs can develop a cybersecurity preparedness and response framework. It supplements existing HDO emergency management and/or incident response capabilities with regional preparedness and response recommendations for medical device cybersecurity incidents. The revised version includes more explicit alignment with the Hospital Incident Command System for managing complex incidents, considerations for the widespread impacts and extended downtimes that are common during cyber incidents, and an appendix of resources.

Download the “Medical Device Cybersecurity Regional Incident Preparedness and Response Playbook

Download the “Medical Device Cybersecurity Regional Incident Preparedness and Response Playbook Quick Start Companion Guide

Back in July 2022, we commented on the new IEC 81001-5-1, a lifecycle process standard.  Read more:  New Cybersecurity Standard

About the author

John is a 25 year FDA veteran. John served as a regulatory and compliance expert for FDA regulated computers and software. Practice (focus) areas include FDA software related guidances, software device classification determination, pre-market software review, post market software inspectional 483’s, additional information software requests, Digital Health Pre-certification, AAMI Software related TIRs and related medical device software standards.

Upcoming SoftwareCPR Training Courses:

Public Course – Jan 9-11, 2023 – Risk Management (in-person)

Our newly updated ISO 14971:2019 Medical Device Risk Management, A Software Organization’s Perspective public training course is now open for registration!

Where:  Tampa, Florida

  • Coverage of ISO 14971:2019, IEC 62304; amd1, and IEC/TR 80002-1.
  • System level hazards analysis – mapping to software, cybersecurity, and usability
  • Why FMEA is incomplete for medical device risk management.
  • How to perform software hazards analysis.
  • And more!

3-days onsite with group exercises, quizzes, examples, Q&A.

Instructors: Dr. Peter Rech, Brian Pate

Discount Registration through October 31, 2022.  Reserve your spot!

Register here: https://events.eventzilla.net/e/2023-softwarecpr-public-training-course–iso-14971-medical-device-risk-management-a-software-organizations-perspective-2138576610


Public Course – Dec 12-15, 2022 – Being Agile & Yet Compliant (virtual)

COST: 4 half days for $1,920 per person

HOURS: 11 am until 3 pm EDT each day

TRAINING LOCATION: Virtual – live online

Register here:



Corporate Office

15148 Springview St.
Tampa, FL 33624
Partners located in the US (CA, FL, MA, MN, TX) and Canada.