As per new rule along with other documents we need to submit
Cybersecurity Documentation
The type of documentation that we recommend you submit in your premarket submission is summarized in this section. These recommendations are predicated on your effective implementation and management of the quality system in accordance with the Quality System Regulation, including Design Controls.6
In the premarket submission, manufacturers should provide the following information related to the cybersecurity of their medical device:
Hazard analysis, mitigations, and design considerations pertaining to intentional and unintentional cybersecurity risks associated with your device, including:
A specific list of all cybersecurity risks that were considered in the design of your device;
A specific list and justification for all cybersecurity controls that were established for your device.
A traceability matrix that links your actual cybersecurity controls to the cybersecurity risks that were considered;
To assure continued safe and effective device use, the systematic plan for providing validated updates and patches to operating systems or medical device software, as needed, to provide up-to-date protection and to address the product life-cycle;
Appropriate documentation to demonstrate that the device will be provided to purchasers and users free of malware; and
Device instructions for use and product specifications related to recommended anti-virus software and/or firewall use appropriate for the environment of use, even when it is anticipated that users may use their own virus protection software.