Page 147 - Safety Risk Management for Medical Devices

126 Safety Risk Management for Medical Devices

Next, analyze the safety risk potential from the security Risk Controls themselves.
Reduce the safety risks due to the security Risk Controls to as low as possible.
While it is difficult to predict the probability of a cybersecurity exploit, it may be
possible to estimate the probability of Hazards due to the security Risk Controls, because
they are implemented under the manufacturer’s control. For example, if an encryption
algorithm is used to protect certain data, it may be possible to estimate the probability
of an error in the encryption/decryption process.
By this point, safety risks due to security threats are reduced to as low as possible.
If the overall risks of the product are found to be acceptable, and the product is
released, postmarket risk management processes should be used to maintain and
update the risk management file with respect to security threats in the same manner
as other safety risks.