Expert: FDA Cyber Guidance For Medical Devices Needs More Work

The article reports University of Michigan Professor Kevin Fu's critique of the FDA's draft post-market medical device cybersecurity guidance, arguing it is overly focused on known threats and connected-device modalities rather than on risk and outcomes. Fu recommends adopting a risk-based approach aligned with NIST guidance, cautions about the limitations of ISAOs and current monitoring practices, and highlights the need to address insecure post-market updates and continuous measurement of security controls.