Q&A with the FDA on Cybersecurity Policy

Dr. Kevin Fu is Associate Professor of Computer Science & Engineering at the University of Michigan, where he conducts research on computer security and healthcare as part of the National Science Foundation's Trustworthy Health and Wellness (THAW.org) Frontiers project. He also directs the Archimedes Center for Medical Device Security, whose mission is to improve medical device security through research and education, and he co-founded Virta Labs, a healthcare cybersecurity company based in Ann Arbor, Michigan. Over the last decade, Kevin has given nearly 100 invited talks on medical device security to industry, government, and academia—including Senate and House hearings, the Institute of Medicine, and National Academy of Engineering events. Beginning with his 2006 security seminar at FDA CDRH, Kevin's medical device security efforts were recognized with a Fed100 Award, Sloan Research Fellowship, NSF CAREER Award, MIT TR35 Innovator of the Year award, and best paper awards on medical device security by organizations such as IEEE and ACM. Kevin earned a Ph.D., master's degree, and bachelor's degree from MIT and he also holds a certificate of achievement in artisanal bread making from the French Culinary Institute.

Nastassia Tamari is the Division Director for Medical Device Cybersecurity within the Division of Medical Device Cybersecurity (DMDC), housed within the Office of Readiness and Response (ORR) in the Office of Strategic Partnerships and Technology Innovation (OST) in FDA CDRH. The Division of Medical Device Cybersecurity provides leadership and strategic direction for medical device cybersecurity policy. As part of DMDC, she leads a team which develops policy related to medical device cybersecurity to advance national preparedness and responds to cybersecurity incidents involving medical devices. She spent more than a decade at a private medical device manufacture [sic] focusing on cybersecurity, security operations and strategic regulatory alignment. She earned a B.A. in Communication from San Diego State University and completed graduate work at Boston University earning an M.S. in Journalism.

Justin Post is currently a Policy Analyst (Cybersecurity) in the Immediate Office – Digital Health within CDRH's OPEQ. The Immediate Office – Digital Health contributes to FDA's digital health policy and to digital health related programs and activities. It also provides leadership and support to OPEQ staff with premarket and postmarket reviews in alignment with FDA guidance documents with digital health content. As part of the Immediate Office – Digital Health, Justin is focused on premarket and postmarket cybersecurity policy development and implementation across OPEQ's Office of Health Technology (OHT) 1 through 8. Prior to this role, Justin was a lead reviewer in OPEQ's OHT7 (Office of In Vitro Diagnostics) supporting pre-market and post-market review activities. He was also OHT7's lead representative supporting FDA's Digital Health Center of Excellence where he was a contributing author to FDA guidance documents with digital health content and an active participant in digital health related programs and activities. Prior to the FDA, Justin spent 12 years at a global IVD manufacturer holding positions in R&D, Regulatory Affairs and Quality Assurance where he supported the commercialization and maintenance of regulated IVD products in US and ex-US markets.