Software Bill of Materials (SBOM)

The Software Bill of Materials (SBOM) has emerged as a fundamental requirement for managing third-party and open-source software components, especially in safety-critical applications like medical devices.

With the increasing cybersecurity threats and regulatory scrutiny, ISO 62304 and FDA cybersecurity guidelines emphasize the need for SBOM to enhance transparency, improve software maintenance, and mitigate cybersecurity risks. This blog post explores the role of SBOM in ISO 62304, its significance in FDA cybersecurity guidelines, and how it strengthens cybersecurity management in medical device software.

What is a Software Bill of Materials (SBOM)?

An SBOM is a comprehensive list of software components, including open-source, proprietary, and third-party software, used in a system or product. It provides visibility into:

• Software components (including third-party and open-source libraries)
• Dependencies (nested software elements within other components)
• Version numbers and licensing information
• Known vulnerabilities associated with included software
• Sources and suppliers of each component

SBOMs are particularly critical in regulated industries such as medical devices, where software safety and cybersecurity vulnerabilities can directly impact patient health and data security.

The Role of SBOM in ISO 62304

Overview of ISO 62304

ISO 62304 is the international standard for medical device software lifecycle processes. It defines requirements for software development, maintenance, risk management, and problem resolution. While it does not explicitly mention the software bill of materials, its principles align with the Software Bill of Material requirements by emphasizing:

• Software configuration management (Clause 8)
• Software maintenance processes (Clause 6.4)
• Risk management of software components (Clause 4.3)

How SBOM Aligns with ISO 62304

1. Software Identification and Traceability
   • ISO 62304 mandates that manufacturers document software components used in a medical device.
   • SBOM provides full traceability of all software elements, ensuring compliance with this requirement.
2. Software Risk Management
   • Clause 4.3 of ISO 62304 requires risk analysis of software components.
   • By maintaining an up-to-date the software bill of materials, manufacturers can proactively identify security vulnerabilities in third-party components and mitigate potential risks.
3. Software Maintenance and Updates
   • Clause 6.4 requires a defined maintenance process for software updates and patches.
   • A Software Bill of Material aids in tracking software versions and dependencies, facilitating timely updates and security patches.
4. Configuration Management
   • Clause 8 specifies the need for software configuration management, ensuring all software elements are documented and controlled.
   • SBOM acts as a living document that maintains a structured record of all software configurations.

FDA Cybersecurity Guidelines and SBOM

FDA’s Stance on SBOM

The U.S. Food and Drug Administration (FDA) has increasingly emphasized cybersecurity requirements for medical device software. In its 2023 Cybersecurity Guidance for Medical Devices, FDA highlights SBOM as a critical element in premarket submissions for cybersecurity risk management.

Key requirements related to the Software Bill of Material in FDA guidance include:

1. Transparency in Software Components
   • FDA mandates that manufacturers provide a detailed SBOM as part of premarket submissions.
   • This ensures transparency into third-party and open-source software usage.
2. Vulnerability Management
   • FDA expects manufacturers to continuously monitor and address cybersecurity vulnerabilities in their SBOM-listed components.
   • Tools like the National Vulnerability Database (NVD) and Common Vulnerabilities and Exposures (CVE) database should be used to track security issues.
3. Patch Management and Software Updates
   • The FDA requires that manufacturers implement a robust patch management process to address security threats.
   • SBOM helps track which components require security patches and ensures timely updates.
4. End-of-Life (EOL) Software Tracking
   • FDA warns against using outdated or unsupported software.
   • The Software Bill of Material assists in identifying obsolete software components and planning transitions to supported versions.

Connection Between SBOM and Cybersecurity Management

Cybersecurity Risk Mitigation

By maintaining the software bill of materials, medical device manufacturers can:

• Identify and mitigate known vulnerabilities by continuously monitoring third-party component security updates.
• Reduce attack surfaces by avoiding outdated or insecure software components.
• Improve incident response by knowing exactly which software components are affected during a cybersecurity event.

Regulatory Compliance and Audit Readiness

SBOM simplifies compliance with:

• ISO 62304 software documentation requirements
• FDA cybersecurity expectations for premarket submissions
• NIST cybersecurity framework and IEC 81001-5-1 health software cybersecurity standards

Supply Chain Security

• The software bill of material helps track third-party software suppliers, ensuring compliance with security best practices.
• Prevents supply chain attacks by verifying software integrity and authenticity.

Best Practices for SBOM Management in Medical Device Software

To effectively implement the software bill of material in compliance with ISO 62304 and FDA cybersecurity guidelines, manufacturers should:

1. Automate software bill of materials Generation
   • Use tools like Software Composition Analysis (SCA) to dynamically generate and maintain SBOM.
2. Integrate SBOM into Risk Management
   • Link SBOM entries with vulnerability scanning tools (e.g., CVE, NVD databases).
3. Implement Continuous Monitoring
   • Regularly update the software bill of material with the latest security patches and component versions.
4. Ensure the software bill of materials Completeness
   • Document all direct and indirect dependencies, ensuring no software element is overlooked.
5. Standardize the software bill of materials Format
   • Use recognized formats like CycloneDX or SPDX to ensure interoperability and regulatory compliance.
6. Audit SBOM Regularly
   • Conduct periodic reviews to identify outdated components and ensure security controls remain effective.

Conclusions

The Software Bill of Materials is a crucial element in managing software risks, cybersecurity, and regulatory compliance in medical devices. Both ISO 62304 and FDA cybersecurity guidelines highlight the importance of maintaining a comprehensive SBOM to ensure software transparency, vulnerability tracking, and efficient software maintenance.

With the growing threats in medical device cybersecurity, adopting a robust SBOM strategy not only helps meet regulatory requirements but also strengthens patient safety and data security. By integrating software bill of material into cybersecurity management, medical device manufacturers can proactively reduce risks, enhance regulatory compliance, and improve software integrity in the ever-evolving healthcare technology landscape.

Subscribe to 4EasyReg Newsletter

4EasyReg is an online platform dedicated to Regulatory matters within the medical device, information security and AI-Based business.

We offer a wide range of documentation kits to support your compliance efforts towards a wide range of standards and regulations, such as ISO 13485, EU MDR, ISO 27001, ISO 42001 and much more. . Specifically, in our webshop you will find:

• ISO 13485 Documentation / Compliance Kit
• ISO 27001 Documentation / Compliance Kit
• ISO 42001 Documentation / Compliance Kit
• FDA Cybersecurity Documentation

Within our sister platform QualityMedDev Academy, a wide range of online & self-paced training courses is available, such as for example:

• Complaint Handling and Vigilance Reporting
• Artificial Intelligence in Medical Device. Regulatory Requirements
• Unique Device Identification (UDI) Requirements according to EU MDR
• Clinical Evaluation Process According to EU MDR
• Medical Device SW Verification & Validation
• Risk Management for Medical Devices
• Usability Evaluation for Medical Devices

As one of the leading online platforms in the medical device sector, 4EasyReg offers extensive support for regulatory compliance. Our services cover a wide range of topics, from EU MDR & IVDR to ISO 13485, encompassing risk management, biocompatibility, usability, software verification and validation, and assistance in preparing technical documentation for MDR compliance.

Do not hesitate to subscribe to our Newsletter!