Medical-device cybersecurity: frequently asked questions
Sytance · Updated
These answers cover common questions about FDA and EU requirements, the cyber-device definition, technical records, patches and user information.
Regulatory boundaries
No. Software is central, but the file also covers device architecture, interfaces, update paths, data flows, operating environment, user information, vulnerability handling, and clinical impact.
No. A US submission addresses FDA requirements, including section 524B when applicable. An EU technical file explains conformity with MDR or IVDR. Some design and test records may support both, but their use must be explained against the relevant requirements.
Not automatically. Section 524B requires the device to meet all three criteria concerning software, internet connection capability and susceptibility to cybersecurity threats. The cyber-device page explains each criterion and the applicable submission pathways.
Evidence records
No. An SBOM lists software components. A threat model explains how architecture, interfaces, data flows, misuse, and attack paths can affect safety, performance, or effectiveness.
No. It is a lifecycle process standard for health software. It can support secure development and maintenance evidence, but legal obligations still come from the applicable regulator and product law.
Lifecycle and users
It depends on jurisdiction, device status, risk, patient-harm potential, correction or removal rules, and whether the update is routine maintenance or addresses a serious issue.
User information should explain what the intended user needs to do for secure operation. State the required configuration and IT environment, how to obtain updates and recover operation, and which responsibilities belong to the user or healthcare organisation.