CCE Medical Device Cybersecurity and Information Security

Question 1

Which FDA guidance document specifically addresses cybersecurity considerations for medical devices in premarket submissions?

Accepted Answer

Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions

Answer

510(k) Premarket Submission Guidance for Software

Answer

ISO 14971 Medical Device Risk Management

Answer

NIST Special Publication 800-53

Question 2

What is the primary purpose of a Software Bill of Materials (SBOM) in medical device cybersecurity?

Accepted Answer

To provide a complete inventory of all software components and dependencies in a medical device

Answer

To document software development costs for reimbursement

Answer

To outline user training requirements for device operators

Answer

To describe the network topology for device connectivity

Question 3

Which cybersecurity framework published by NIST is most commonly referenced for healthcare cybersecurity risk management?

Accepted Answer

NIST Cybersecurity Framework (CSF)

Answer

ISO 27001 Information Security Management

Answer

COBIT 5 Governance Framework

Answer

ITIL v4 Service Management

Question 4

What does 'MDS²' refer to in the context of medical device security?

Accepted Answer

Manufacturer Disclosure Statement for Medical Device Security

Answer

Medical Device Safety Standards document

Answer

Multi-Device Software Security standard

Answer

Medical Device System Security specification

Question 5

Which network architecture approach is recommended to isolate medical devices from general hospital networks?

Accepted Answer

Network segmentation using VLANs or dedicated subnets

Answer

Flat network topology with a central firewall

Answer

Peer-to-peer mesh networking for all clinical devices

Answer

Bus topology with shared bandwidth allocation

Question 6

What is the purpose of a coordinated vulnerability disclosure program in medical device security?

Accepted Answer

To allow researchers to report vulnerabilities so manufacturers can develop patches before public disclosure

Answer

To publicly announce all device vulnerabilities immediately upon discovery

Answer

To prevent independent security researchers from testing medical devices

Answer

To establish legal protections for manufacturers against security lawsuits

Question 7

Which U.S. regulatory body has authority over medical device cybersecurity in both premarket and post-market phases?

Accepted Answer

Food and Drug Administration (FDA)

Answer

Centers for Medicare & Medicaid Services (CMS)

Answer

Federal Communications Commission (FCC)

Answer

Cybersecurity and Infrastructure Security Agency (CISA)