DevOps in an ISO 13485 Regulated Environment

Abstract

Background: Medical device development projects must follow proper directives and regulations to be able to market and sell the end-product in their respective territories. The regulations describe requirements that seem to be opposite to efficient software development and short time-to-market. As agile approaches, like DevOps, are becoming more and more popular in software industry, a discrepancy between these modern methods and traditional regulated development has been reported. Although examples of successful adoption in this context exist, the research is sparse. Aims: The objective of this study is twofold: to review the current state of DevOps adoption in regulated medical device environment; and to propose a checklist based on that review for introducing DevOps in that context. Method: A multivocal literature review is performed and evidence is synthesized from sources published between 2015 to March of 2020 to capture the opinions of experts and community in this field. Results: Our findings reveal that adoption of DevOps in a regulated medical device environment such as ISO 13485 has its challenges, but potential benefits may outweigh those in areas such as regulatory, compliance, security, organizational and technical. Conclusion: DevOps for regulated medical device environments is a highly appealing approach as compared to traditional methods and could be particularly suited for regulated medical development. However, an organization must properly anchor a transition to DevOps in top-level management and be supportive in the initial phase utilizing professional coaching and space for iterative learning; as such an initiative is a complex organizational and technical task. CCS CONCEPTS• Software and its engineering→Agile software development • Applied computing→Life and medical sciences • Social and professional topics→Medical technologies

Microservice security: a systematic literature review

“…The answers we gathered for this question surprised us. Indeed, security standards are a staple element of industries and organisations that want to impose and guarantee a certain level of security on their members and collaborators (often also for certification purposes – Stewart, Chapple & Gibson, 2012 , Lie, Sánchez-Gordón & Colomo-Palacios, 2020 ). Despite their widespread use in practice, only 7 publications mention security standards.…”

DevOps as a culture of interaction and deployment in an insurance company.

“…It can also be understood as a conglomerate or amalgam of these, which is characterized by breaking down the walls that obstruct and separate the development of operations, in order to direct them to common goals based on collaboration and continuous improvements [14]. DevOps can be understood as a culture and philosophy for a successful organization [15,16]. Such a culture allows the reduction in delivery time in each development flow and, in addition, ensures the quality of the development, demonstrating the benefits in the data record in a detailed way.…”

Holding on to Compliance While Adopting DevSecOps: An SLR

“…Compliance is one of the identified aspects besides the DevSecOps definition, security best practices, process automation, tools for DevSecOps, software configuration, team collaboration, availability of activity data, and information secrecy. Lie et al [55] carried out a Multivocal Literature Review (MLR) to identify the regulatory compliance of DevOps in a regulated medical device context. They concluded that DevOps for such a context is a highly appealing approach and noted specific contradictions between DevOps and IEC 62304 medical device software.…”