Regulatory Compliance & Security Standards Flashcards
7 cards from real CPMS practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Regulatory Compliance & Security Standards flashcards as text
The FDA's 2023 final rule on cybersecurity for medical devices (Section 524B of FD&C Act) requires manufacturers to submit a Software Bill of Materials (SBOM). The primary purpose of the SBOM is to:
Answer: Enable identification of software components and their known vulnerabilities
An SBOM provides a comprehensive inventory of software components, enabling manufacturers and users to rapidly identify which products are affected when new vulnerabilities in third-party components are disclosed.
Under ISO 14971:2019, the risk management process requires that residual risks be evaluated against:
Answer: Benefits of the intended use, weighed using an overall risk-benefit analysis
ISO 14971:2019 requires that overall residual risk be weighed against the overall benefit of the device's intended use, and the risk-benefit analysis must conclude that benefits outweigh risks.
Which regulatory pathway is most appropriate for a novel Class III medical software device with no predicate device?
Answer: Premarket Approval (PMA)
Class III devices that cannot claim substantial equivalence and do not qualify for De Novo must submit a Premarket Approval (PMA) application, the most stringent FDA premarket review pathway.
SOC 2 Type II reports differ from SOC 2 Type I reports primarily because Type II reports:
Answer: Assess the design AND operating effectiveness of controls over a period of time
SOC 2 Type II evaluates both the design suitability and the operating effectiveness of controls over an observation period (typically 6–12 months), whereas Type I assesses only design at a single point in time.
A medical device manufacturer must retain Device History Records (DHRs) under 21 CFR Part 820 for a minimum of:
Answer: The expected life of the device or 2 years from the date of release, whichever is longer
21 CFR 820.184 requires DHRs to be retained for a period equivalent to the design and expected life of the device, but in no case less than 2 years from the date of release for commercial distribution.
In a threat modeling exercise for a networked infusion pump, the STRIDE model categorizes 'an attacker forging dosage commands by impersonating a clinician workstation' under which threat category?
Answer: Spoofing
Spoofing in the STRIDE model refers to an attacker illegitimately assuming the identity of another user, system, or device—exactly what occurs when commands are forged by impersonating a legitimate clinician workstation.
The EU MDR requires manufacturers of Class IIb and Class III devices to perform clinical follow-up through a Post-Market Clinical Follow-Up (PMCF) plan. When must this plan be updated?
Answer: Continuously, as part of the ongoing post-market surveillance system
Under EU MDR Article 83 and Annex XIV, PMCF is an ongoing process integrated into the post-market surveillance system, not a one-time or event-triggered activity.