Agencies issue guidance on minimum software elements for cybersecurity improvements

The Cybersecurity and Infrastructure Security Agency and other U.S. and international agencies July 29 released joint guidance outlining minimum elements for a “software bill of materials” for organizations to better understand and improve their cybersecurity efforts. The guidance updates and replaces minimum elements suggested by the National Telecommunications and Information Administration in 2021. An SBOM lists all components contained in a software product. Other types of software, such as artificial intelligence and software-as-a-service in cloud environments, may require additional elements. Section 524B of the Federal Food, Drug, and Cosmetic Act requires medical device manufacturers to provide an SBOM. This applies to new medical device applications submitted to the Food and Drug Administration after Oct. 1, 2023.

“Take a look at the many software components that run a medical imaging device as an example,” said Scott Gee, AHA deputy national advisor for cybersecurity and risk. “The device itself may not be listed as compromised, but one deeply embedded software component could contain an unpatched technical vulnerability that may lead to compromise of the device and, therefore, the hospital network it’s attached to.”

For more information on this or other cyber and risk issues, contact Gee at sgee@aha.org or John Riggi, AHA national advisor for cybersecurity and risk, at jriggi@aha.org. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity.