Section 1. Authority

This compilation summarizes requirements derived from:

1. Section 524B of the Federal Food, Drug, and Cosmetic Act, as codified at 21 U.S.C. § 360n-2, added by Section 3305 of the Food and Drug Omnibus Reform Act of 2022 (FDORA), Public Law 117-328, Division FF, Title III, § 3305(a), enacted December 29, 2022.
2. Section 510(k), 513, 515(c), 515(f), and 520(m) of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. §§ 360(k), 360c, 360e(c), 360e(f), and 360j(m)).
3. FDA's general authorities under 21 CFR Part 820 (Quality System Regulation) and 21 CFR 10.115 (Good Guidance Practices).

Section 2. Purpose and Scope

(a) Purpose

This document establishes requirements and recommendations for ensuring the cybersecurity of medical devices to:

1. Protect patient safety by ensuring medical devices are sufficiently resilient to cybersecurity threats;
2. Ensure the continued safety and effectiveness of devices throughout their total product lifecycle;
3. Establish procedures for monitoring, identifying, and addressing postmarket cybersecurity vulnerabilities and exploits;
4. Provide reasonable assurance that devices and related systems are cybersecure.

(b) Scope

1. These requirements apply to all cyber devices as defined in Section 3 of this document.
2. The requirements became effective March 29, 2023, for all premarket submissions submitted on or after that date.
3. The FDA's refuse to accept policy for incomplete cybersecurity information became effective October 1, 2023.

Section 3. Definitions

For purposes of this document, the following definitions apply:

(a) Cyber device

A device that:

1. includes software validated, installed, or authorized by the sponsor as a device or in a device;
2. has the ability to connect to the internet; and
3. contains any such technological characteristics validated, installed, or authorized by the sponsor that could be vulnerable to cybersecurity threats.

(b) Cybersecure

The state of a device and related systems having adequate protection against unauthorized access, modification, or disruption that could compromise safety, effectiveness, or security of the device or the data it processes.

(c) Secure Product Development Framework (SPDF)

A set of processes that reduce the number of potentially exploitable weaknesses in a device's software and establish design and development processes that meet cybersecurity requirements.

(d) Software Bill of Materials (SBOM)

A comprehensive list that includes commercial, open-source, and off-the-shelf software components contained in the device software.

(e) Coordinated vulnerability disclosure

A process for receiving information about potential cybersecurity vulnerabilities in devices from security researchers and other stakeholders and coordinating remediation and public disclosure.

(f) Related systems

Any software, hardware, or network components that could affect or be affected by the cybersecurity of the medical device.

Section 4. Premarket Submission Requirements

(a) General requirements

Under Section 524B of the FD&C Act and related FDA guidance, premarket applications or submissions for a cyber device must include information sufficient to demonstrate that the device meets all cybersecurity requirements specified in this section.

(b) Required cybersecurity documentation

Each premarket submission for a cyber device must include:

1. Cybersecurity management plan
   1. A plan to monitor, identify, and address postmarket cybersecurity vulnerabilities and exploits in a reasonable time;
   2. Coordinated vulnerability disclosure procedures and related processes;
   3. Procedures for security patch management and software updates.
2. Security risk management documentation
   1. A security risk assessment identifying potential vulnerabilities, threats, and mitigations;
   2. A threat model analyzing reasonably foreseeable cybersecurity risks;
   3. Documentation of security controls implemented to address identified risks;
   4. Evidence that security controls have been tested and validated.
3. Software Bill of Materials (SBOM)
   1. A comprehensive listing of all commercial software components;
   2. Identification of all open-source software components;
   3. Documentation of all off-the-shelf software components;
   4. Version information and known vulnerabilities for each component.
4. Security architecture documentation
   1. System diagrams showing all communication pathways and interfaces;
   2. Authentication and authorization mechanisms;
   3. Data encryption methods for data at rest and in transit;
   4. Security event logging and detection capabilities.
5. Cybersecurity testing documentation
   1. Results of vulnerability scanning and assessment;
   2. Penetration testing results, where applicable;
   3. Static and dynamic code analysis results;
   4. Third-party security assessment reports, if available.

(c) Design and development requirements

Manufacturers shall design, develop, and maintain processes and procedures to:

1. Provide reasonable assurance that the device and related systems are cybersecure;
2. Implement security by design principles throughout the product development lifecycle;
3. Establish and maintain configuration management and change control procedures;
4. Ensure secure software development practices are followed.

Section 5. Postmarket Cybersecurity Maintenance

(a) Update and patch management

Note: Under Section 524B and FDA guidance, manufacturers must maintain processes to monitor, identify, and address vulnerabilities and should provide updates and patches, including out-of-cycle fixes for critical vulnerabilities.

Manufacturers shall make available postmarket updates and patches to address:

1. Regular cycle updates
   1. Known unacceptable vulnerabilities on a reasonably justified regular cycle;
   2. Routine security improvements and enhancements;
   3. Updates to third-party software components.
2. Emergency updates
   1. Critical vulnerabilities that could cause uncontrolled risks as soon as possible out of cycle;
   2. Actively exploited vulnerabilities;
   3. Vulnerabilities that could result in patient harm.

(b) Vulnerability monitoring and disclosure

1. Manufacturers shall establish procedures for continuous monitoring of cybersecurity vulnerabilities;
2. A coordinated vulnerability disclosure policy shall be maintained and publicly accessible;
3. Vulnerabilities shall be assessed for risk and addressed according to severity;
4. Communication plans shall be established for notifying users of significant vulnerabilities.

(c) Incident response

Manufacturers shall maintain capabilities for:

1. Detection and analysis of security incidents;
2. Containment and remediation of security breaches;
3. Recovery and restoration of device functionality;
4. Documentation and reporting of significant cybersecurity incidents.

Section 6. Manufacturer Responsibilities and Reporting

(a) Quality system integration

Cybersecurity requirements shall be integrated into the manufacturer's quality system, including:

1. Design controls addressing cybersecurity risks;
2. Risk management procedures incorporating cybersecurity considerations;
3. Validation and verification activities for security controls;
4. Change control procedures for security-related modifications.

(b) Labeling requirements

Device labeling shall include:

1. Instructions for users regarding secure configuration and use;
2. Description of security features and their proper use;
3. Information about device interfaces and communication capabilities;
4. Recommended cybersecurity controls for the use environment.

(c) Documentation maintenance

Manufacturers shall maintain:

1. Current security risk assessments;
2. Records of vulnerability assessments and remediation;
3. Documentation of security testing performed;
4. Records of security-related complaints and adverse events.

(d) End-of-support planning

1. Manufacturers shall provide advance notice of software end-of-support dates;
2. Plans for device decommissioning and secure disposal shall be provided;
3. Options for continued security support or device replacement shall be communicated.

Section 7. FDA Oversight and Enforcement

(a) Premarket review

1. FDA will evaluate whether submissions contain required cybersecurity information;
2. Submissions lacking required information may be subject to refuse to accept decisions;
3. FDA will assess whether there is reasonable assurance of device cybersecurity.

(b) Refuse to accept policy

1. Effective dates
   1. Requirements became effective March 29, 2023;
   2. FDA refrained from issuing refuse to accept decisions solely for cybersecurity reasons before October 1, 2023;
   3. Beginning October 1, 2023, FDA may refuse to accept submissions lacking required cybersecurity information.
2. Exceptions
   1. Applications or submissions submitted before March 29, 2023, are not subject to these requirements;
   2. FDA may work collaboratively with sponsors during the review process to address deficiencies.

(c) Postmarket surveillance

1. FDA may request additional cybersecurity information for marketed devices;
2. Manufacturers shall report cybersecurity vulnerabilities that may impact device safety or effectiveness;
3. FDA may require corrective actions for inadequately addressed cybersecurity risks.

(d) Exemptions

The Secretary may identify devices, or categories or types of devices, that are exempt from meeting the cybersecurity requirements. Such exemptions shall be published in the Federal Register and updated as appropriate if any are identified.

Section 8. Implementation

(a) Guidance documents

FDA has issued and may periodically update guidance documents to assist manufacturers in meeting these requirements, including:

1. "Cybersecurity in Medical Devices: Refuse to Accept Policy for Cyber Devices and Related Systems Under Section 524B of the FD&C Act" (March 30, 2023);
2. "Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions" (September 27, 2023, updated June 27, 2025);
3. Future guidance as determined necessary by the Secretary (check the FDA site for subsequent updates).

(b) Transitional provisions

1. Devices cleared or approved before March 29, 2023, are not required to retrospectively meet these requirements unless subject to new premarket submissions;
2. Modifications to existing devices that require premarket notification shall include cybersecurity documentation if the modification impacts cybersecurity.

(c) Pending rulemaking

Implementation of additional requirements under Section 524B(b)(4) of the FD&C Act remains pending further rulemaking. The Secretary may promulgate regulations establishing additional cybersecurity requirements as necessary to ensure devices and related systems are cybersecure.

(d) Comprehensive compliance considerations

Organizations implementing medical device cybersecurity programs should note that compliance with FDA requirements represents only one component of a comprehensive cybersecurity compliance framework. Additional requirements may apply based on:

• The organization's role (manufacturer, covered entity, business associate, healthcare provider)
• The type of data processed (ePHI, personally identifiable information, clinical trial data)
• Geographic markets served (EU MDR, UK MHRA, Health Canada requirements)
• Contractual obligations with healthcare customers or supply chain partners
• Industry standards and best practices (NIST Cybersecurity Framework, ISO 27001, IEC 62304)