https://www.youtube.com/watch?v=DwFW_24-T8w

Cybersecurity:

• Cybersecurity - focused on exploitability rather than the impact of that risk. And not the intentions of a malicious hacker to go after the software - instead how is the software vulnerable to cybersecurity exploitation?

• Software, probability difficult to assess, need to determine if realistic ???
  Likelihood of cybersecurity events and impact on patient safety??

At time of draft guidances they were a little conflicting

** SRS and SDS**

Some traceability system should be in place. Nice to provide a description of how we perform traceability. FDA doesn’t expect a trace matrix specifically because there are other ways of fulfilling.

SRS - High level design SDS - Low level stuff

So how does the high level design gets translated into the lower level design that software developers are using for coding process?

62304 asks for a trace matrix to show traceability though.

Not looking for an excel file with the link between them for the PMA submission. FDA wants to see critical risks are traced through from requirements.

Internally document traceability from user needs down through test cases. FDA primarily looking for the risk assessment piece.

FDA not looking at source code, only documentation.

Risk control measures –> Requirement where implemented, where tested. And need processes in place to accomplish this.

** Software version history**

During development make many different versions that might be used for hardware, usability, etc testing.

What versions need to be described in a submission?

–> Want to know what versions of software was used for each type of testing.

Doesn’t have to be like every commit / build, but want to know about the builds that were used for testing.

** 62304 software safety class vs FDA documentation level**

Documentation level is quite different from software safety classification. It’s hard to directly relate them.

In some areas A&B match with basic, and C with enhanced (?) but not generally.

** Detail level of documentation to be submitted**

Does FDA need like executed protocols and test reports along with the summary stuff?

For enhanced, in addition to system level testing also want to see unit level integration test protocols and reports.

FDA does want to see test cases that were executed, was it pass or fail, if it failed what was the outcome (did the overall test fail or was that individual failure justified to be OK?)

** Cloud services**

In FDA diagrams, cloud services are shown as COTS.

If a cloud service is far removed from device function eg load balancing, this kind of stuff is not regulated by FDA.

In architecture diagrams, FDA wants to be able to see if something is being performed onsite or somewhere else.

** Classification of device vs documentation level**

Probably Class III –> Enhanced

But in general, software class doesn’t dictate documentation level.