FDA postmarket cybersecurity for medical devices
Sytance · Updated
FDA postmarket cybersecurity management assesses new vulnerabilities in devices already in use. Manufacturers need to determine the possible harm to patients, decide how to address the risk and communicate the action needed by users. The response may include a software fix, a temporary control or a field action.
Lifecycle risk
Medical devices may remain in use for years after release. FDA's postmarket guidance addresses the new vulnerabilities, attack techniques, component issues and deployment changes that arise during that time.
The team needs the design and release records to investigate a new vulnerability. Identify which supported versions contain the affected component, how the vulnerable function is used and which controls apply. This allows the team to assess the devices customers are actually operating.
Assessing potential patient harm
FDA's postmarket cybersecurity risk decision focuses on whether a vulnerability could create patient harm, including death or physical injury. Privacy or business-impact concerns can still matter, but they are not the patient-harm test in this guidance.
Lifecycle maintenance
A postmarket process monitors vulnerability sources, evaluates new information, validates fixes, communicates with users and updates fielded devices through planned and urgent paths.
Versions in use
The same component vulnerability can have different risk consequences across versions, configurations, use environments and compensating controls. The assessment must preserve that context.
Controlled and uncontrolled risk
FDA divides postmarket cybersecurity vulnerability risk into controlled and uncontrolled risk. The decision is not whether a vulnerability exists. The decision is whether the residual patient-harm risk is acceptable after existing or available controls are considered.
Controlled risk
Controlled risk means the residual risk of patient harm is sufficiently low or acceptable. Routine security updates, routine patches and best-practice labelling changes usually sit here when they only address controlled risk.
Uncontrolled risk
Uncontrolled risk means existing controls leave unacceptable residual risk of patient harm. FDA recommends prompt remediation. Under 21 CFR 806.10, manufacturers or importers must report corrections or removals initiated to reduce a risk to health or remedy a device violation that may present such risk, within 10 working days of initiation. Exemptions and reports already made under parts 803 or 1004 must be considered. Separately, FDA’s guidance describes conditions for not enforcing part 806 reporting; those conditions do not remove the regulatory obligation.
Uncontrolled risk is present when there is unacceptable residual risk of patient harm due to insufficient risk mitigations and compensating controls.
FDA postmarket cybersecurity guidance, December 2016 (original English)
Routine updates and patches
FDA treats many cybersecurity updates and patches as ordinary device enhancements when they improve security or remediate vulnerabilities associated with controlled risk. Those routine updates are generally not the kind of correction or removal that must be reported under 21 CFR part 806.
An update needed to reduce uncontrolled risk requires a different reporting analysis. This also applies when exploitation has a reasonable probability of causing serious adverse health consequences or death. Even when no part 806 report is expected, the manufacturer still needs to validate the update and manage its distribution and communication.
- Routine security updates can include patches, hardening changes and labelling updates for secure configuration or best practice.
- Routine status depends on patient-harm risk, not on whether the change is technically small.
- The same patch can be routine for one product configuration and urgent for another if the residual patient-harm risk differs.
Operating the postmarket process
The postmarket process needs defined responsibilities and resources for monitoring, receiving reports, assessing risk, validating fixes and communicating with customers. Records of those activities support later FDA review.
Monitor reports from users, researchers and component suppliers, together with internal findings and relevant vulnerability intelligence. A change in the healthcare IT environment can also alter the device’s exposure. Route the information to people who can assess its effect on supported products.
FDA expects vulnerability assessment to consider exploitability and severity of patient harm. Threat modelling and safety-risk analysis should be used together so the team can identify whether the vulnerability affects clinical performance, availability, integrity, confidentiality or safe operation.
For uncontrolled risk, FDA’s reporting enforcement-discretion conditions include communication to customers and the user community, interim controls and a remediation plan as soon as possible, no later than 30 days after learning of the vulnerability. As soon as possible, no later than 60 days after learning of it, the manufacturer should validate and distribute a deployable fix, or provide a long-term compensating control that makes risk acceptable, with end-user follow-up as needed. Conditions also include no known associated serious adverse events or deaths, active ISAO participation and sharing customer communications.
FDA's ISAO concept is not passive membership. The manufacturer should share vulnerability and threat information, use documented policies, connect received intelligence to risk assessments and retain traceable records of communication, countermeasures and mitigations.
Connection to premarket files
Premarket records provide the starting point for postmarket assessment. A premarket threat model becomes the baseline for postmarket triage. A premarket SBOM becomes the component inventory for vulnerability monitoring. A premarket security architecture becomes the map for deciding whether a new vulnerability can reach a safety-relevant function.
- Keep the SBOM current for marketed configurations and preserve version context for fielded devices.
- Update threat models when deployment assumptions, update paths, external services or vulnerabilities change.
- Use postmarket findings to update risk management, labelling, customer instructions, support plans and future premarket submissions.
- Before distributing a patch, verify the fix and check the device functions that the change could affect.
Sources
- 21 CFR 806.10, Reports of corrections and removals
- FDA, Postmarket Management of Cybersecurity in Medical Devices, final guidance, December 2016
- FDA, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions, final guidance, February 2026
- FDA, Cybersecurity in Medical Devices: Frequently Asked Questions