FDA Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions
FDA guidance establishing cybersecurity expectations for medical device manufacturers throughout the total product lifecycle. 42 requirements across secure product development framework (SPDF), threat modelling, security architecture, authentication and authorisation, cryptography and data protection, software bill of materials (SBOM), security testing and vulnerability management, postmarket monitoring and coordinated vulnerability disclosure, patch and update management, labelling and transparency, and interoperability security. Addresses both premarket submission requirements and postmarket management obligations. Enacted under Section 524B of the FD&C Act (Consolidated Appropriations Act 2023).
| Clause | Title | SP 800-53 Controls |
|---|---|---|
| 524B-1 | Section 524B — Mandatory SBOM for Premarket Submissions | |
| 524B-2 | Section 524B — Postmarket Vulnerability Monitoring Plan | |
| 524B-3 | Section 524B — Coordinated Vulnerability Disclosure Requirement | |
| 524B-4 | Section 524B — Reasonable Assurance of Cybersecurity | |
| CRA-1 | Cybersecurity Risk Assessment — Exploitability Assessment | |
| CRA-2 | Cybersecurity Risk Assessment — Patient Safety Impact | |
| CRA-3 | Cybersecurity Risk Assessment — Residual Risk Documentation | |
| CVD-1 | Coordinated Vulnerability Disclosure — Policy and Process | |
| CVD-2 | Coordinated Vulnerability Disclosure — CISA/ICS-CERT Coordination | |
| INC-1 | Incident Response — Medical Device-Specific Response | |
| INC-2 | Incident Response — Safety-Focused Triage | |
| INC-3 | Incident Response — Medical Device Reporting (MDR) Obligations | |
| MON-1 | Postmarket Monitoring — Cybersecurity Information Sources | |
| MON-2 | Postmarket Monitoring — Vulnerability Identification and Assessment | |
| MON-3 | Postmarket Monitoring — Threat Intelligence | |
| PU-1 | Patching and Updates — Validated Software Updates | |
| PU-2 | Patching and Updates — Patch Management for Device Software | |
| PU-3 | Patching and Updates — Compensating Controls When Patches Unavailable | |
| SA-1 | Security Architecture — Authentication and Authorisation | |
| SA-2 | Security Architecture — Cryptographic Controls | |
| SA-3 | Security Architecture — Code, Data, and Execution Integrity | |
| SA-4 | Security Architecture — Confidentiality Protections | |
| SA-5 | Security Architecture — Event Detection and Logging | |
| SA-6 | Security Architecture — Resilience and Recovery | |
| SBOM-1 | Software Bill of Materials — Component Inventory | |
| SBOM-2 | Software Bill of Materials — Machine-Readable Format and Maintenance | |
| SBOM-3 | Software Bill of Materials — Component-Level Vulnerability Tracking | |
| SPDF-1 | Secure Product Development Framework — Lifecycle Integration | |
| SPDF-2 | Secure Product Development Framework — Security Risk Management | |
| SPDF-3 | Secure Product Development Framework — Security Architecture Documentation | |
| ST-1 | Security Testing — Static and Dynamic Analysis | |
| ST-2 | Security Testing — Penetration Testing | |
| ST-3 | Security Testing — Fuzz Testing and Robustness | |
| ST-4 | Security Testing — Vulnerability Scanning and SCA | |
| TM-1 | Threat Modelling — Threat Identification and Characterisation | |
| TM-2 | Threat Modelling — Attack Vectors and Trust Boundaries | |
| TM-3 | Threat Modelling — Assumptions and Mitigations | |
| TR-1 | Transparency — Cybersecurity Documentation for Users | |
| TR-2 | Transparency — Residual Risk Communication | |
| TR-3 | Transparency — Compensating Controls Guidance | |
| VR-1 | Vulnerability Response — Controlled vs Uncontrolled Risk | |
| VR-2 | Vulnerability Response — Remediation Timeline Expectations |