CPMS Regulatory Compliance & Security Standards 3

Question 1

The FDA's 2023 final rule on cybersecurity for medical devices (Section 524B of FD&C Act) requires manufacturers to submit a Software Bill of Materials (SBOM). The primary purpose of the SBOM is to:

Accepted Answer

Enable identification of software components and their known vulnerabilities

Answer

An SBOM provides a comprehensive inventory of software components, enabling manufacturers and users to rapidly identify which products are affected when new vulnerabilities in third-party components are disclosed.

Question 2

Under ISO 14971:2019, the risk management process requires that residual risks be evaluated against:

Accepted Answer

Benefits of the intended use, weighed using an overall risk-benefit analysis

Answer

ISO 14971:2019 requires that overall residual risk be weighed against the overall benefit of the device's intended use, and the risk-benefit analysis must conclude that benefits outweigh risks.

Question 3

Which regulatory pathway is most appropriate for a novel Class III medical software device with no predicate device?

Accepted Answer

Premarket Approval (PMA)

Answer

Class III devices that cannot claim substantial equivalence and do not qualify for De Novo must submit a Premarket Approval (PMA) application, the most stringent FDA premarket review pathway.

Question 4

SOC 2 Type II reports differ from SOC 2 Type I reports primarily because Type II reports:

Accepted Answer

Assess the design AND operating effectiveness of controls over a period of time

Answer

SOC 2 Type II evaluates both the design suitability and the operating effectiveness of controls over an observation period (typically 6–12 months), whereas Type I assesses only design at a single point in time.

Question 5

A medical device manufacturer must retain Device History Records (DHRs) under 21 CFR Part 820 for a minimum of:

Accepted Answer

The expected life of the device or 2 years from the date of release, whichever is longer

Answer

21 CFR 820.184 requires DHRs to be retained for a period equivalent to the design and expected life of the device, but in no case less than 2 years from the date of release for commercial distribution.

(CPMS) Certified Professional for Medical Software Practice Test

(CPMS) Certified Professional for Medical Software Practice Test

CPMS Regulatory Compliance & Security Standards 3