Configuration Drift in Medtech: When Validated Systems Quietly Change

How Guardian proves the certified state of medtech systems

In medical technology, configuration integrity is patient safety. A device is only as safe as the state it shipped in. Yet medtech organisations have to manage highly complex IT estates. This complexity provides greater opportunity for configuration drift and cyber incidents to occur, putting patient safety at risk. In fact, 93% of healthcare organisations suffered a cyberattack last year.

Regulators are converging on the same question. ISO 13485 requires validation of the software used in your quality system, while 21 CFR Part 11 requires audit trails that can withstand regulatory inspection. NIS2 also brings medical device and in vitro diagnostic (IVD) manufacturers into scope as important entities across the EU, with the UK NIS Regulations providing a similar framework. While the regulations differ, they all require organisations to maintain a clear record of system changes, who approved them and the evidence needed to demonstrate compliance.

Guardian is our configuration monitoring platform. It captures a known-good baseline of the systems you validated, then reassesses them at the cadence you set. Every deviation is flagged with a record of what changed, when it changed, and how it differs from the approved baseline. Vendor-agnostic, across your hybrid estate. It proves your systems are still in the state you certified, and shows you the moment they are not. 

Consider the change that lands on a validated server outside the change window. No ticket, no approval record, no one intending harm. Guardian flags it against the baseline, with the evidence attached. The alternative is finding it during an inspection, and explaining to an auditor why the system is not in the state your documentation says it is.

Check out the video below to learn how Guardian helps medtech companies prove their estate is in a known-good state.