CCE Medical Device Cybersecurity and Information Security

Question 1

Which FDA guidance document specifically addresses cybersecurity considerations for medical devices in premarket submissions?

Accepted Answer

Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions

Answer

The FDA released 'Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions' to guide manufacturers on cybersecurity requirements during premarket submissions.

Question 2

What is the primary purpose of a Software Bill of Materials (SBOM) in medical device cybersecurity?

Accepted Answer

To provide a complete inventory of all software components and dependencies in a medical device

Answer

An SBOM provides a complete inventory of software components and dependencies, enabling identification and remediation of known vulnerabilities across the device's software supply chain.

Question 3

Which cybersecurity framework published by NIST is most commonly referenced for healthcare cybersecurity risk management?

Accepted Answer

NIST Cybersecurity Framework (CSF)

Answer

The NIST Cybersecurity Framework (CSF) provides a policy framework organized around Identify, Protect, Detect, Respond, and Recover functions, widely adopted for healthcare cybersecurity risk management.

Question 4

What does 'MDS²' refer to in the context of medical device security?

Accepted Answer

Manufacturer Disclosure Statement for Medical Device Security

Answer

MDS² (Manufacturer Disclosure Statement for Medical Device Security) is a standardized form used by device manufacturers to disclose security characteristics and capabilities to healthcare organizations.

Question 5

Which network architecture approach is recommended to isolate medical devices from general hospital networks?

Accepted Answer

Network segmentation using VLANs or dedicated subnets

Answer

Network segmentation using VLANs or dedicated subnets creates separate network zones, limiting the attack surface and preventing lateral movement if a device is compromised.

CCE - Certified Clinical Engineer Practice Test

CCE - Certified Clinical Engineer Practice Test

CCE Medical Device Cybersecurity and Information Security