Medical Device Vulnerability Management

Reconcile every SBOM component against NVD, CISA KEV, GitHub Security Advisories, and vendor PSIRT feeds daily. Automate the diff - manual monthly reviews miss the 24-72 hour window where an exploited vulnerability becomes an FDA-reportable event.

CVSS base scores ignore clinical impact. Layer a rubric that considers patient-safety severity, exploitability given the device's network posture, and the population of fielded devices. FDA's postmarket guidance expects both a technical score and a clinical-risk determination.

Publish a security.txt at your marketing domain and a plain-language CVD policy: how researchers report, your acknowledgment SLA, safe-harbor language, and expected fix windows. CISA and FDA both point to ISO/IEC 29147 and 30111 as the reference model.

Stand up a Product Security Incident Response Team with named owners, a triage queue, and SLAs by severity (e.g. critical acknowledged in 24h, mitigated in 30 days). Reviewers ask for this org chart in postmarket audits.

A patch that fixes the CVE but breaks a clinical workflow is worse than the vulnerability. Regression-test every patch against your verification suite, including any device-specific interoperability (DICOM, HL7/FHIR, MedRadio) before releasing.

A CVE in a linked library may not be exploitable in your device (unused code path), may not be applicable (different config), or not reachable (no network exposure). Document the reasoning per finding in a VEX document so customers and reviewers can act on your actual risk, not the raw CVE count.

Under the Cyber Resilience Act, actively exploited vulnerabilities and severe incidents in devices sold in the EU must be reported to ENISA within 24 hours (early warning) and 72 hours (full notification). Wire this into your PSIRT runbook - the clock starts when you know, not when you fix.

CISA and healthcare ISACs increasingly ingest CSAF 2.0 (Common Security Advisory Framework) rather than PDF bulletins. Publishing CSAF advisories accelerates HDO patching and satisfies FDA's postmarket communication expectations.

A vulnerability that surprised you means your threat model missed a component, trust boundary, or attacker capability. Update the model and STRIDE analysis after every postmarket finding - this is the loop reviewers look for in a mature SPDF.

Trend MTTR by severity in your Quality Management System. Rising MTTR is an early warning of process breakdown and shows up in FDA inspections. Set an internal target (e.g. 30 days for high, 90 for medium) and review quarterly.

Hospitals rarely patch on your schedule. Provide compensating controls (network segmentation guidance, IOC signatures, WAF rules) alongside the patch so HDOs can mitigate before their maintenance window arrives.

An SBOM is only correct for a specific build. Regenerate on every release, sign it (e.g. with Sigstore), and retire prior SBOMs from your distribution channels so customers do not scan against stale component data.