Medical-device cybersecurity

Sytance · Updated October 6, 2026

Medical-device cybersecurity addresses threats that can affect device safety and performance throughout its life. Manufacturers use design records, threat models, SBOMs and testing to assess those risks, then maintain protection through updates, user information and postmarket monitoring. Regulatory requirements differ between the United States and the European Union.

Regulatory requirements and technical work

For a US submission, start with FDA premarket guidance and the section 524B criteria. For EU conformity assessment, start with MDR or IVDR requirements. The technical pages explain the supporting work, from architecture and risk assessment to testing and postmarket maintenance.

FDA premarket evidence

FDA recommends explaining how the device was securely designed and tested, and how its cybersecurity risks will be managed after release. Section 524B sets additional legal requirements for qualifying cyber-device submissions.

FDA postmarket management

FDA postmarket guidance explains how to assess newly discovered vulnerabilities and decide whether existing controls remain adequate. The resulting patient-safety risk affects the urgency of remediation and the applicable reporting considerations.

EU MDR and MDCG evidence

MDR and IVDR address information security within software development and risk management. The technical documentation and instructions need to explain safe use in the intended IT environment. MDCG 2019-16 gives guidance on applying these requirements.

Lifecycle records

IEC 81001-5-1 describes secure development and maintenance activities for health software. The technical pages explain how architecture, component information and test results help assess a device and maintain it after release.

Reading order

FDA premarket cybersecurity for submission content, section 524B, security architecture, testing, labelling and management plans.
FDA postmarket management for vulnerability monitoring, controlled and uncontrolled risk, routine updates, coordinated disclosure and field corrections.
EU MDR and MDCG cybersecurity for Annex I software and security requirements, intended operating environment evidence, user information, PMS and vigilance.
IEC 81001-5-1 for the secure health-software lifecycle process that can support FDA and EU evidence without replacing either framework.
SBOMs and threat modelling for the two records most often confused with each other, and for how they connect to architecture, testing and postmarket monitoring.

Regulatory split

US and EU submissions can draw on the same device design and test results, but the legal requirements differ. For example, section 524B specifies content for qualifying US cyber-device submissions. EU cybersecurity work follows the applicable MDR or IVDR requirements. Explain how the technical records address the requirements of the market concerned.