The \"Consolidated Appropriations Act of 2023\" (more commonly referred to as the Omnibus Act) was passed and signed into law on December 29th, 2022. This amendment to the Food and Drug Cosmetic Act has expanded the scope of the FDA beyond just \"safety and efficacy\" to include the cybersecurity of medical devices. This amendment resembles a watered-down version of the PATCH Act, which failed to pass in late 2022.
As a result, on March 29, 2023, the FDA gained the legal authority to define and enforce medical device cybersecurity. So for today\u2019s episode, we got THE leading minds in MedTech cybersecurity together to discuss what we need to do next. Chris Gates, Director of Product Security at Velentium, Chris Reed, Vice President of Product Security at Medtronic, and Ken Hoyme, CEO of Dark Star Consulting, join the podcast today to discuss the new guidelines, what the FDA can and can\u2019t say about it, and what kinds of deficiencies you\u2019ll be seeing in the future because of the new legislation.
\u201cLiterally, if you\u2019re not aware of this already, you\u2019re already behind the 8-ball right now and there\u2019s things you\u2019ve got to do.\u201d
\u201cBasically, if you think it might be a cyber device, it is a cyber device.\u201d
\u201cDon\u2019t sit there and try to be pedantic about this and say \u201cI don\u2019t need to do this because there\u2019s a comma here.\u201d It ain\u2019t gonna work for you.\u201d
\u201cA synonym for threat modeling really is security architecture analysis.\u201d
Medical Device Cybersecurity in 2023 and Beyond Slides