令和2年5月13日 厚生労働省医薬・生活衛生局医療機器審査管 …

1 0513 0513 1 3 ( imdrf ) 27 28 0428 0428 30 24 0724 0724 ( imdrf )

2 Principles and Practices for Medical Device Cybersecurity ) imdrf imdrf imdrf imdrf imdrf /CYBER WG/N60 FINAL:2020 : : : 2020 3 18 Dr Choong May Ling, Mimi, imdrf Copyright 2020 by the International Medical Device Regulators Forum imdrf /CYBER WG/N60 FINAL:2020 2020/3/18 Page 2 of 51.

3 5 .. 6 .. 7 .. 9 .. 10 .. 10 .. 10 .. 10 .. 11 .. 11 TPLC .. 14 .. 17 TPLC .. 17 .. 18 .. 18 .. 18 .. 20 .. 20 .. 20 .. 20 TPLC .. 21 .. 21 .. 21 .. 21 .. 21 .. 23 .. 23 .. 23 .. 24 imdrf /CYBER WG/N60 FINAL:2020 2020/3/18 Page 3 of 51.

4 25 .. 26 .. 26 .. 26 .. 28 ( ) .. 28 .. 28 .. 28 .. 31 .. 34 .. 36 .. 36 .. 37 .. 38 .. 38 .. 40 .. 42 .. 43 imdrf .. 43 .. 43 .. 44 .. 45 .. 47 A: (ISO/IEC 27035 ) .. 48 B: .. 50 imdrf /CYBER WG/N60 FINAL:2020 2020/3/18 Page 4 of 51 (International Medical Device Regulators Forum: imdrf ) imdrf imdrf /CYBER WG/N60 FINAL.

5 2020 2020/3/18 Page 5 of 51 imdrf 2 3 4 5 6 imdrf imdrf imdrf /GRRP WG/N47 FINAL: 2018 In Vitro Diagnostic IVD 1 Total Product Life Cycle TPLC imdrf / samd WG/N12 FINAL.

6 2014 Software as Medical Device samd 1 N47 imdrf /CYBER WG/N60 FINAL:2020 2020/3/18 Page 6 of 51 IVD samd

7 National Institute of Standard and Technology NIST imdrf /CYBER WG/N60 FINAL:2020 2020/3/18 Page 7 of 51 imdrf /GRRP WG/N47 FINAL: 2018 Asset) ISO/IEC JTC 1/SC 41 N0317, 2017-11-12 Attack ISO/IEC 27000:2018 Authentication ISO/IEC 27000:2018 Authenticity ISO/IEC 27000:2018 Authorization SO 27789.

8 2013 ISO 7498-2 Availability ISO/IEC 27000:2018 Compensating Risk Control Measure (Compensating Control) AAMI TIR97:2019 : Confidentiality ISO/IEC 27000:2018 imdrf /CYBER WG/N60 FINAL:2020 2020/3/18 Page 8 of 51 Coordinated Vulnerability Disclosure CVD AAMI TIR97:2019.

9 ISO 81001-1 End of Life EOL EOL EOL End of Support EOS IEC 60601-1:2005+AMD1:2012 Exploit ISO/IEC 27039:2015 Integrity : SO/IEC 29167-19:2016 Legacy Medical Device (Legacy Device) Non-Repudiation ISO/IEC 27000:2018 Patient Harm (ISO/IEC Guide 51:2014 ) Privacy ISO/TS 27799:2009 imdrf /CYBER WG/N60 FINAL.

10 2020 2020/3/18 Page 9 of 51 Threat ISO/IEC Guide 120 Threat Modeling ISO/IEC/IEEE 24765-2017 Update 1: ISO/IEC 14764:2006 2: 3: Validation ISO 9000:2015 1: " " 2: Verification ISO/IEC Guide 63 1: 2: 3: " " Vulnerability ISO/IEC 27000:2018 imdrf /CYBER WG/N60 FINAL:2020 2020/3/18 Page 10 of 51