Australia Therapeutic Goods (Medical Devices) Regulations 2002 sch1-12.1-b: Essential principle 12.1(5) and (6): build and maintain cybersecurity by best practice (protection against unauthorised access, vulnerability management, patching, disclosure and update information) and keep performance-influencing data representative, of sufficient quality, intact and managed to reduce bias

What does sch1-12.1-b require?

Programmed devices and medical device software must be designed, produced and maintained to best practice in software, security and engineering so that they are cyber secure, including where appropriate: protection against unauthorised access, influence or manipulation; minimising risk from known vulnerabilities by remediation or compensating controls; making updates, patches and compensating controls easy to apply; disclosing known vulnerabilities and mitigations; and giving users enough information to decide whether applying an update is safe. Having regard to the intended purpose, the state of the art and best practice, the manufacturer must also ensure that the data that influences the device's performance (for example training and test data for machine learning models) is representative, of sufficient quality, maintained with integrity and managed to reduce bias.