Hardware Podcasts

Shifting Sands of SaMD Cybersecurity Regulations

Global Medical Device Podcast · 6 Jul 2022 · 33m · Episode 270

What this episode covers

Chris Gates, Director of Product Security at Velentium, critiques the FDA's new draft guidance on cybersecurity for Software as a Medical Device (SaMD), arguing it imposes massive burdens on manufacturers without improving security. He highlights the PATCH Act's legacy device clause, which may force manufacturers to end support for older products due to unsustainable compliance costs. Gates advocates for aligning with existing consensus standards like ISO 14971 and NTIA SBOM definitions rather than creating new, misaligned regulatory artifacts.

Most relevant to

early-stage companies

Topics

Mentioned

Companies
Velentium, FDA, NTIA, CISA, NIST, IMDRF, Greenlight Guru
Also
PATCH Act, ISO 14971

Related episodes from other shows

Other shows on the same ground, closest first.

  • Let's Combinate · 1h 03m

    021 - "Options" with Karandeep Singh Badwal

    Karandeep Singh Badwal, a QA/RA consultant and host of The MedTech Podcast, explains how defining 'intended use' determines whether a product is a regulated medical device or unregulated software, a critical distinction for startups. He details the specific regulatory challenges of Software as a Medical Device (SaMD), including cybersecurity, GDPR compliance, and the impact of the EU MDR on software classification. Badwal also discusses the strategic advantages for UK software companies post-Brexit, where they can still self-certify as Class 1 devices while EU counterparts face stricter notified body audits.

    Validation & product-market fitQuality & yield
    9 chapters

  • Coredump Sessions · 1h 03m

    #000: How New IoT Security Regulations Will Shape the Industry's Future

    François Baldassari, founder and CEO of Memfault, and co-founder/CTO Chris Coleman discuss the impact of new IoT security regulations, specifically the EU's Cyber Resilience Act (CRA) and the US FCC's Cyber Trust Mark. They argue that OTA updates, Software Bill of Materials (SBOM) tracking, and device observability are now mandatory for compliance, moving security from an afterthought to a core engineering requirement. The hosts highlight that ignoring these regulations risks severe liability, citing recent pager explosions and Shimano bike shacker hacks as examples of physical dangers from insecure connected devices.

    Security & privacyEmbedded firmware
    9 chapters

  • Let's Combinate · 41m

    134 - ISO62304, Software Development Process, SaMD, Closed Loop Systems, Complexities with Cloud and Better Software in MedTech with Richard Koch

    Richard Koch, founder of KochSaMD, explains the complexities of developing cloud-based medical devices, using a closed-loop insulin pump system as a primary case study. He details how ISO 62304 governs software development within the broader ISO 13485 framework, emphasizing the shift from batch-based physical manufacturing to continuous, high-velocity software updates. Koch warns that tech giants like Apple and Google are disrupting the industry by leveraging their digital expertise to acquire or compete with traditional medtech firms, urging leaders to upskill in software development to survive.

    Embedded firmwareConnected products & IoT
    7 chapters

  • Let's Combinate · 30m

    140 - Medical Device & Diagnostics Cybersecurity, 3rd Party Software, SBOM's, Evaluating Skill and Mindset with Christian Espinosa

    Christian Espinosa, CEO of Blue Goat Cyber, explains the unique cybersecurity challenges of medical devices, emphasizing that patient safety is the primary driver over data privacy. He details the importance of Software Bill of Materials (SBOM) and identifying third-party open-source components, such as the Shellshock vulnerability, to mitigate supply chain risks. Espinosa also discusses his hiring philosophy for Blue Goat Cyber, prioritizing practical aptitude and clarity of purpose over formal certifications or degrees.

    Security & privacyPCB design & layout
    6 chapters

  • Coredump Sessions · 58m

    #008: Navigating the Changing IoT Security Landscape: A Survival Guide for Product Leaders

    Giovanni Alberto Falcione, CTO at Exine, joins Memfault's François Baldassari and Thomas Sarlandie to discuss the impact of the EU's Cyber Resilience Act (CRA) on IoT security. They analyze the shift from voluntary standards like NIST 800-53 to mandatory compliance, highlighting the critical need for runtime security monitoring and Software Bill of Materials (SBOM) tracking. The conversation details how eBPF technology enables low-overhead anomaly detection and how OTA updates are essential for mitigating vulnerabilities in the field.

    Security & privacyEmbedded firmware
    6 chapters

The summary, chapters and topics are generated from the episode’s audio by this directory, not written by Global Medical Device Podcast. The episode itself belongs to its publisher.