Cybersecurity Requirements under MDR
The European Union Medical Device Regulation (EU MDR 2017/745) provides a comprehensive regulatory framework covering medical software and connected devices. This regulation makes it mandatory for software that directly affects patient safety (Software as a Medical Device — SaMD) to systematically manage cybersecurity risks.
For products within the MDR scope to obtain CE marking, manufacturers must document cybersecurity risk analysis and technical security testing in addition to the Clinical Evaluation process. The MDCG (Medical Device Coordination Group) guidance documents designate penetration testing as a fundamental verification method.
Software used for medical purposes (image analysis, diagnostic assistance systems, patient monitoring applications) is classified as a medical device under MDR; cybersecurity requirements apply to this software as well.
Medical Software Security Testing Scope
TUGAY's penetration testing services for the healthcare sector are structured to meet the technical requirements of MDR and the relevant MDCG guidelines:
- Medical software and web portal security tests (OWASP Top 10)
- Patient data access control and authorization management tests
- Medical device-software communication protocol security (HL7, DICOM, FHIR)
- Cloud-based healthcare platform security assessment
- Authentication and session management vulnerabilities
- Data encryption and transmission security controls
- Third-party library and API security analysis
Test Methodology
- Risk Model Development: A threat model and attack surface analysis are conducted in accordance with MDR Annex I safety requirements.
- Static Code Analysis (SAST): Security vulnerabilities are identified at the source code level; medical data processing logic is reviewed.
- Dynamic Application Testing (DAST): Real-time attack simulations are applied on the running application.
- API Security Testing: RESTful and FHIR API endpoints are tested for authentication, authorization, and data leakage.
- Infrastructure and Network Testing: Server configurations, network segmentation, and access control are verified.
Reporting and CE Marking Support
Test reports are prepared in a format compliant with MDR Technical Documentation requirements. The evidence required for Notified Body audits is presented systematically.
- Findings mapped to MDR Annex I Article 17 requirements
- Cybersecurity risk assessment report
- Residual risk analysis and acceptability assessment
- Security recommendations integrated into the software development process