FDA Medical Device Cybersecurity Guidelines

Premarket and postmarket cybersecurity requirements for connected medical devices, including software bill of materials.

Analysis

Premarket Cybersecurity Documentation: Manufacturers must submit detailed cybersecurity documentation as part of premarket submissions, including a risk-based assessment, architecture documentation, and a comprehensive cybersecurity management plan. This must address device design, threat modeling, and mitigation strategies according to the device’s risk profile. See the FDA Final Guidance (2025), FDA Guidance Summary, and FDA Cybersecurity Guidelines 2024 Guide.

Software Bill of Materials (SBOM): Submissions must include an SBOM listing all software components (including third-party and open-source) to support vulnerability management and transparency. See FDA Guidance Document and Sternum IoT Guide.

Secure Product Development Framework (SPDF): Manufacturers are required to implement an SPDF, integrating cybersecurity throughout the product lifecycle—from design and development to decommissioning. This framework must address vulnerability identification, mitigation, and patch management. See FDA Guidance Document and Sternum IoT Guide.

Postmarket Cybersecurity Vigilance: Manufacturers must have processes for ongoing monitoring, vulnerability disclosure, timely patching, and communication of security issues for devices in the field. See FDA Guidance Document and Johner Institute Blog.

Explicit Definition of “Cyber Devices”: The guidance applies to any device containing software, regardless of network capability, expanding the scope to include all software-based devices. See FDA Final Guidance (2025) and Emergo by UL News.

Twelve Required Cybersecurity Documents: The FDA expects 12 specific documents as part of the eSTAR submission process, covering all aspects of cybersecurity risk management. See FDA Final Guidance (2025) and Emergo by UL News.

Complexity of Legacy Systems: Many organizations struggle to retrofit cybersecurity controls into legacy devices that were not designed with security in mind. See Sternum IoT Guide and Emergo by UL News.

SBOM Generation and Maintenance: Creating and maintaining an accurate SBOM is challenging, especially for devices using third-party or open-source components. See FDA Guidance Document and Johner Institute Blog.

Resource Constraints: Smaller manufacturers may lack the resources or expertise to implement robust cybersecurity programs, particularly for ongoing postmarket monitoring and rapid patch deployment. See Emergo by UL News.

Real Example: In 2023, the FDA began issuing “Refuse to Accept” (RTA) letters for submissions lacking required cybersecurity documentation, delaying market entry for several manufacturers. See Sternum IoT Guide and FDA RTA Policy.

Integrate Cybersecurity Early: Embed cybersecurity risk management into the design and development process using a Secure Product Development Framework (SPDF). See FDA Guidance Document and IMDRF Principles.

Automate SBOM Creation: Use automated tools to generate and update SBOMs, ensuring all software components are tracked. See NTIA SBOM Resources and FDA SBOM Guidance.

Continuous Monitoring and Patch Management: Establish processes for ongoing vulnerability monitoring, timely patch deployment, and transparent communication with users. See FDA Postmarket Guidance and Johner Institute Blog.

Leverage Industry Frameworks: Align with recognized frameworks such as NIST Cybersecurity Framework and IMDRF cybersecurity principles. See NIST Cybersecurity Framework and IMDRF Principles.

June 27, 2025: FDA released its final guidance, consolidating and clarifying requirements for all software-based medical devices, regardless of network connectivity. See FDA Final Guidance (2025) and Emergo by UL News.

Expanded Definition of Cyber Devices: Now includes any device containing software, not just network-enabled devices. See FDA Final Guidance (2025) and Johner Institute Blog.

Effective Dates and Deadlines: The 2025 guidance is effective immediately for new submissions; manufacturers of existing devices must comply with postmarket requirements and update documentation as required. See FDA Final Guidance (2025).

FD&C Act Section 524B: Establishes statutory requirements for cybersecurity in medical devices, including SBOM and postmarket controls. See FD&C Act Section 524B.

IMDRF Principles and Practices for Medical Device Cybersecurity: Provides international harmonization of cybersecurity requirements. See IMDRF Principles.

NIST Cybersecurity Framework: Widely adopted for risk management and referenced in FDA guidance. See NIST Cybersecurity Framework.

Manufacturer Disclosure Statement for Medical Device Security (MDS2): Standardized disclosure of device security capabilities. See NEMA MDS2.

IEC 62304: International standard for medical device software lifecycle processes, referenced for secure development. See IEC 62304 Overview.

Increased Regulatory Scrutiny: Manufacturers face more rigorous premarket reviews, with the FDA issuing RTA letters for non-compliance, leading to delays and increased costs. See Sternum IoT Guide and Emergo by UL News.

Operational Changes: Organizations must invest in cybersecurity expertise, tools, and lifecycle management processes, impacting budgets and resource allocation. See FDA Guidance Document and Johner Institute Blog.

Global Harmonization: Alignment with IMDRF and NIST frameworks supports international market access but increases the complexity of compliance for multinational manufacturers. See IMDRF Principles and NIST Cybersecurity Framework.

2025-11-01 — Industry experts note that the new FDA cybersecurity requirements under Section 524B increase compliance burdens and enforcement risks, with manufacturers needing to demonstrate robust security measures throughout the device lifecycle.[9] (source)