HSA GL-10 Medical Device Cybersecurity: Best Practices for Connected Healthcare Devices

The growing use of connected medical devices has transformed healthcare by improving patient monitoring, diagnosis, and treatment. However, connected devices also introduce cybersecurity risks that can affect patient safety, sensitive medical information, and healthcare operations. Medical device manufacturers and healthcare providers must adopt effective security practices to manage these risks throughout a device's lifecycle.

Singapore's Health Sciences Authority (HSA) published the GL-10 Best Practices Guide for Medical Device Cybersecurity, Revision 1, in August 2026. The guide provides practical recommendations for protecting connected medical devices from development and deployment through ongoing support and end of support. Read the official HSA medical device guidance.

What Is HSA GL-10 Medical Device Cybersecurity?

HSA GL-10 is a best-practices guide designed to help medical device manufacturers, product registrants, importers, local authorised representatives, and healthcare providers understand cybersecurity responsibilities.

It addresses cybersecurity across the total product life cycle, including secure product development, risk assessment, security testing, vulnerability management, software updates, and end-of-support planning.

The guide applies to connected general medical devices and in-vitro diagnostic (IVD) devices supplied in Singapore, including devices already installed and in use. Importantly, GL-10 provides recommendations rather than establishing regulatory requirements for pre-market submissions or product registration.

Why Is Medical Device Cybersecurity Important?

Connected medical devices can communicate with hospital networks, cloud platforms, mobile applications, and other healthcare systems. If attackers exploit weaknesses in these connections, they may compromise sensitive information or disrupt clinical operations.

Common cybersecurity risks include:

• Data breaches: Unauthorised access to patient records and confidential medical information.
• Device manipulation: Exploitation of vulnerabilities that could affect device behaviour or integrity.
• Ransomware attacks: Disruption of healthcare systems and connected medical equipment.
• Software vulnerabilities: Security weaknesses in operating systems, third-party libraries, and device applications.
• Unsupported devices: Increased exposure to threats when manufacturers stop providing security updates.

A comprehensive medical device cybersecurity strategy helps organisations identify these risks, implement appropriate controls, and protect patient safety.

Key Cybersecurity Best Practices Under HSA GL-10

1. Implement Security by Design

Manufacturers should integrate cybersecurity into the device development process rather than treating it as a final-stage activity. Security considerations should influence product architecture, authentication, access controls, communication protocols, and software development.

Early risk assessment helps development teams identify potential attack paths and introduce suitable safeguards before devices reach the market.

2. Conduct Cybersecurity Risk Assessments

A cybersecurity risk assessment helps organisations understand how vulnerabilities could affect device functionality, data confidentiality, system integrity, and patient safety.

The assessment should consider network connectivity, software dependencies, user privileges, external interfaces, and the consequences of successful attacks. Organisations should document identified risks, evaluate their potential impact, and implement suitable mitigation measures.

3. Perform Security Testing and Vulnerability Assessments

Security testing can help identify weaknesses before attackers exploit them. Depending on the device and its risk profile, appropriate activities may include vulnerability assessments, penetration testing, security configuration reviews, and software analysis.

Testing should take place in a controlled environment with clearly defined scope and safety precautions. For devices that support clinical activities, teams must avoid testing methods that could disrupt patient care or compromise device functionality.

Organisations can also review their medical device penetration testing and HSA guidance to understand how structured security testing can support a broader cybersecurity programme.

4. Maintain a Software Bill of Materials

A Software Bill of Materials (SBOM) identifies the software components included in a medical device. It can help manufacturers and healthcare organisations identify vulnerable third-party components and determine whether security updates are necessary.

An effective SBOM management process should support vulnerability monitoring, component identification, risk assessment, and timely remediation throughout the device lifecycle.

5. Establish Vulnerability Management and Patch Procedures

Manufacturers should establish processes to identify, evaluate, communicate, and address security vulnerabilities. When a vulnerability affects a device, organisations should assess its potential impact and determine appropriate corrective actions.

Security updates should be distributed through trusted channels, with clear installation instructions and relevant risk information. Healthcare providers should coordinate with manufacturers to apply updates safely and evaluate alternative controls when immediate patching is not possible.

6. Protect Medical Devices During Deployment and Use

Healthcare providers should implement operational controls to reduce exposure to cyber threats. These may include network segmentation, strong authentication, restricted administrative access, secure configurations, logging, monitoring, and regular backups where appropriate.

Healthcare teams should also maintain an inventory of connected devices, track software versions, and establish procedures for reporting suspicious activity or security incidents.

7. Plan for End of Support

When a manufacturer stops providing cybersecurity support, a device may become more difficult to protect against newly discovered vulnerabilities.

Manufacturers should communicate support timelines and provide relevant information to help healthcare providers plan for continued use, replacement, or decommissioning. Healthcare providers should evaluate the risks of unsupported devices and introduce appropriate compensating controls when continued use is necessary.

Who Should Follow HSA GL-10?

HSA GL-10 outlines cybersecurity best practices for several stakeholders across the medical device supply chain.

• Medical device manufacturers: Integrate security into development, conduct risk assessments, test products, and manage vulnerabilities.
• Product registrants and importers: Support communication and coordination of cybersecurity information and corrective actions
• Local authorised representatives: Facilitate relevant cybersecurity communications and support activities in Singapore.
• Healthcare providers: Manage device security during procurement, installation, operation, maintenance, and end-of-support stages.

Cybersecurity works best when these stakeholders collaborate and clearly understand their responsibilities.

How Can Penetration Testing Support Medical Device Cybersecurity?

Penetration testing helps organisations evaluate whether attackers could exploit weaknesses in a device, application, network, or supporting infrastructure. When performed appropriately, it provides evidence that can inform remediation and cybersecurity risk management.

A structured assessment may include:

1. Defining the testing scope and identifying the devices, interfaces, and software versions involved.
2. Reviewing the device architecture, network exposure, and security controls.
3. Identifying vulnerabilities through approved testing methods
4. Validating findings safely in a controlled environment.
5. Documenting technical evidence, potential impacts, and remediation recommendations.
6. Retesting after corrective actions to verify that identified weaknesses have been addressed.

Testing should complement secure development, vulnerability monitoring, patch management, and other lifecycle security activities. It should not be treated as a substitute for comprehensive cybersecurity risk management.

Conclusion

HSA GL-10 provides practical guidance for strengthening medical device cybersecurity throughout the total product life cycle. By implementing secure-by-design principles, conducting risk assessments, maintaining an SBOM, performing appropriate security testing, and managing vulnerabilities, organisations can improve their security posture and help protect patients.

Medical device manufacturers and healthcare providers operating in Singapore should review the latest guidance and determine which recommendations are relevant to their products and operational environments.

Read more: HSA GL-10 Medical Device Cybersecurity: Best Practices Guide