We assist medical device manufacturers in generating and maintaining a detailed Software Bill of Materials (SBOM), as required by FDA cybersecurity guidelines. Our SBOM services include:

• • Comprehensive inventory of all software components, including commercial and open-source elements.
  • SOUP (Software of Unknown Provenance) analysis to identify and address potential vulnerabilities.
  • Continuous monitoring and maintenance to ensure compliance with post-market management requirements.

Start Your SMOB

We support medical device manufacturers in assessing and mitigating cybersecurity risks. We focus on vulnerabilities that could be exploited in the device’s environment of use and guide you in incorporating cybersecurity risk assessments into your premarket submissions. Our process captures risks and controls from threat models and integrates these insights into safety risk assessments.

• • Exploitability-Focused Assessment: Unlike traditional risk models, we assess cybersecurity risks based on the exploitability of vulnerabilities rather than historical data, aligning with FDA recommendations.
  • Threat Modeling & Risk Scoring: We develop detailed threat models, identifying potential risks and controls, and employ FDA-recommended methods to score risks pre- and post-mitigation. Our risk assessments help prioritize vulnerabilities based on severity and likelihood of exploitation.
  • Integration with Safety Risk Assessments: Our service bridges the gap between cybersecurity and safety risk assessments, ensuring security risks are properly transferred into safety evaluations for compliance with FDA guidelines.
  • Premarket Submission Support: We provide the necessary documentation to include in your premarket submission, ensuring that your risk assessments, scoring methodologies, and mitigation strategies meet FDA expectations.

By leveraging Aerstone’s expertise, you can safeguard your medical device and ensure regulatory compliance while enhancing security and patient safety.

Schedule a discovery session

FDA’s new guidelines for cybersecurity in medical devices require all medical device manufacturers to

• Submit a plan to monitor, identify, and address postmarket cybersecurity vulnerabilities and exploits.
• Design, develop and maintain processes and procedures to provide a reasonable assurance that the device and related systems are “cybersecure,” and make available postmarket updates and patches to the device and related systems to address certain cybersecurity vulnerabilities;

Bringing our decades of experience securing national military, intelligence, and financial infrastructure to the complex world of medical device cybersecurity, we offer manufacturers the expertise needed to create and maintain a comprehensive cybersecurity management plan that aligns with FDA guidelines. We help you implement thorough monitoring and patch management processes, ensuring that your devices remain secure and compliant, from premarket submission through their entire lifecycle.

Let’s Talk

Aerstone’s penetration testing services for medical devices are designed to rigorously identify and exploit security vulnerabilities within the product, ensuring compliance with FDA guidelines. Our penetration testing approach focuses on simulating real-world cyberattacks to assess the effectiveness of the device’s cybersecurity measures.

We provide detailed reports that cover the scope, duration, methods, and results of each test, performed by independent experts with no ties to the development process. This ensures that any security-related issues are unbiasedly identified and addressed before product release, reducing the risk of potential exploitation. Our testing spans various critical areas, including security policy enforcement, performance under maximum traffic conditions, and the stability of the device’s cybersecurity controls.

Get more information

In addition to penetration testing, we offer comprehensive vulnerability scanning services to ensure medical devices are safeguarded against known and emerging threats. Our vulnerability scanning process includes static and dynamic code analysis, boundary assessments, and abuse case testing.

We also conduct attack surface analysis and vulnerability chaining, which examines how vulnerabilities interact and potentially magnify risk. By leveraging advanced tools and methodologies, including fuzz testing and software composition analysis, we help manufacturers identify hardcoded credentials, default passwords, and other exploitable weaknesses. Our reports provide manufacturers with clear evidence of vulnerabilities and offer remediation strategies, ensuring compliance with 21 CFR 820.30 requirements and supporting FDA premarket submission guidelines.

Get Started