MDSAP Audit Approach (MDSAP AU P0002) C5-T12-US: United States: for cyber devices cleared or approved after 29 March 2023, maintain a postmarket vulnerability plan with coordinated disclosure, cybersecure design and update processes, and a software bill of materials

What does C5-T12-US require?

Manufacturers of cyber devices cleared or approved after 29 March 2023 must show they meet section 524B(b) of the Federal Food, Drug, and Cosmetic Act by keeping a plan for finding, monitoring and dealing with postmarket cybersecurity vulnerabilities and exploits in reasonable time (including coordinated vulnerability disclosure), by designing, developing and maintaining processes giving reasonable assurance that the device and connected systems are secure and that updates and patches are made available, and by maintaining a software bill of materials listing commercial, open-source and off-the-shelf software components. Clauses: ISO 13485:2016 4.2.1, 7.1, 7.3.1 to 7.3.10.