# Software Bill of Materials (SBOMs) & Cybersecurity in the Medical Device Industry

- Show: [Global Medical Device Podcast](https://hardwarepodcasts.com/podcast/global-medical-device-podcast)
- Published: 2022-06-01
- Length: 40m
- Episode: 265
- Page: https://hardwarepodcasts.com/podcast/global-medical-device-podcast/2022-06-01-software-bill-of-materials-sboms-cybersecurity-in-the-medical-device-industry
- Listen: https://podcast.greenlight.guru/episode/software-bill-of-materials-sboms-cybersecurity-in-the-medical-device-industry

## Summary

Ken Zalevsky, CEO of Vigilant Ops, explains the critical role of Software Bill of Materials (SBOMs) in medical device cybersecurity, defining them as transparent lists of software components that help hospitals and manufacturers manage risk. He discusses the FDA's evolving regulatory expectations, including the pending pre-market guidance and the 'Burgess Bill,' which mandate SBOMs for 510(k) submissions and require continuous post-market vulnerability monitoring. Zalevsky highlights the challenge of legacy devices, noting that healthcare organizations take an average of 160 days to discover breaches because they often deploy 'black box' devices without knowing their internal software composition. He advises manufacturers to scope cybersecurity efforts appropriately, integrating security into the design phase rather than treating it as a bolt-on, and to use SBOMs to provide necessary transparency to end-users.

## Chapters

- [0:00](https://hardwarepodcasts.com/podcast/global-medical-device-podcast/2022-06-01-software-bill-of-materials-sboms-cybersecurity-in-the-medical-device-industry#t=0) Introduction: Sponsor Read and Guest Overview
- [2:57](https://hardwarepodcasts.com/podcast/global-medical-device-podcast/2022-06-01-software-bill-of-materials-sboms-cybersecurity-in-the-medical-device-industry#t=177) Defining SBOMs and the Transparency Goal
- [6:26](https://hardwarepodcasts.com/podcast/global-medical-device-podcast/2022-06-01-software-bill-of-materials-sboms-cybersecurity-in-the-medical-device-industry#t=386) Safety vs. Security Mindsets in Engineering
- [10:23](https://hardwarepodcasts.com/podcast/global-medical-device-podcast/2022-06-01-software-bill-of-materials-sboms-cybersecurity-in-the-medical-device-industry#t=623) FDA Recalls and Vulnerability Management
- [13:40](https://hardwarepodcasts.com/podcast/global-medical-device-podcast/2022-06-01-software-bill-of-materials-sboms-cybersecurity-in-the-medical-device-industry#t=820) Integrating Cybersecurity into Risk Management
- [19:52](https://hardwarepodcasts.com/podcast/global-medical-device-podcast/2022-06-01-software-bill-of-materials-sboms-cybersecurity-in-the-medical-device-industry#t=1192) Regulatory Expectations and the Burgess Bill
- [24:59](https://hardwarepodcasts.com/podcast/global-medical-device-podcast/2022-06-01-software-bill-of-materials-sboms-cybersecurity-in-the-medical-device-industry#t=1499) Adoption Challenges and Legacy Device Risks
- [31:18](https://hardwarepodcasts.com/podcast/global-medical-device-podcast/2022-06-01-software-bill-of-materials-sboms-cybersecurity-in-the-medical-device-industry#t=1878) The Value of Transparency for Hospitals
- [36:28](https://hardwarepodcasts.com/podcast/global-medical-device-podcast/2022-06-01-software-bill-of-materials-sboms-cybersecurity-in-the-medical-device-industry#t=2188) Standardization and NTIA Minimum Elements

## Topics

- [Security & privacy](https://hardwarepodcasts.com/topic/security-and-privacy)
- [Certification & compliance](https://hardwarepodcasts.com/topic/certification-and-compliance)
- [Design for manufacturing & NPI](https://hardwarepodcasts.com/topic/design-for-manufacturing)
- [Sourcing & supply chain](https://hardwarepodcasts.com/topic/sourcing-and-supply-chain)

## Most relevant to

large enterprises

## Mentioned

- Vigilant Ops (company)
- FDA (company)
- NTIA (company)
- CISA (company)
- NIST (company)
- Greenlight Guru (company)
- Carnegie Mellon (company)
- Harvard Business School (company)
- AAMI TIR57 (other)
- Burgess Bill (other)
- WannaCry (other)
- 510(k) (other)

## Related episodes from other shows

- [140 - Medical Device & Diagnostics Cybersecurity, 3rd Party Software, SBOM's, Evaluating Skill and Mindset with Christian Espinosa](https://hardwarepodcasts.com/podcast/lets-combinate/2024-06-12-140-medical-device-diagnostics-cybersecurity-3rd-party-software-sboms-evaluating) (Let's Combinate)
- [515: Script Boomers](https://hardwarepodcasts.com/podcast/embedded-fm/2025-11-27-515-script-boomers) (Embedded.fm)
- [Biggest Firmware Vulnerabilities & How to Fix Them | NetRise's Thomas Pace | Internet of Things Podcast](https://hardwarepodcasts.com/podcast/iot-for-all-podcast/2023-01-26-biggest-firmware-vulnerabilities-how-to-fix-them-netrises-thomas-pace-internet-o) (IoT For All Podcast)
- [#000: How New IoT Security Regulations Will Shape the Industry's Future](https://hardwarepodcasts.com/podcast/coredump-sessions/2024-09-17-000-how-new-iot-security-regulations-will-shape-the-industrys-future) (Coredump Sessions)
- [How to Speed Up Safety Critical Processes](https://hardwarepodcasts.com/podcast/the-pragmatic-embedded-podcast/2021-07-27-how-to-speed-up-safety-critical-processes) (The Pragmatic Embedded Podcast)

## Citing this page

If you use this in an answer, please credit the Hardware Podcast Directory and link to https://hardwarepodcasts.com/podcast/global-medical-device-podcast/2022-06-01-software-bill-of-materials-sboms-cybersecurity-in-the-medical-device-industry. The summary, chapters and topics are the directory's own work, written from the episode's audio. The episode itself, its title and its audio belong to Global Medical Device Podcast.