Medical Device Cybersecurity Consulting for FDA and EU MDR
Medical device cybersecurity is the set of design controls, documentation and postmarket processes that keep connected devices and medical software safe from cyber threats. It is mandatory for FDA 510(k), De Novo and PMA submissions under section 524B and for CE marking under EU MDR and IVDR. I3CGLOBAL builds the threat model, SBOM, test evidence and submission files reviewers expect.
What Is Medical Device Cybersecurity?
Medical device cybersecurity is the protection of a device, its software and its data against unauthorised access, modification or disruption that could harm patients or stop the device working as intended. Regulators treat it as part of device safety, not as an IT add-on: a security weakness is assessed as a potential hazard, alongside electrical or software failures.
Any device with software that can connect, by Wi-Fi, Bluetooth, USB, a hospital network or the cloud, needs a documented medical device cybersecurity program covering design, the premarket submission and postmarket monitoring.
FDA vs EU Medical Device Cybersecurity at a Glance
| United States (FDA) | European Union (MDR / IVDR) | |
|---|---|---|
| Legal basis | Section 524B of the FD&C Act, in force since 29 March 2023 | Annex I General Safety and Performance Requirements |
| Main guidance | Premarket cybersecurity guidance (June 2025, revised February 2026) | MDCG 2019-16 guidance on cybersecurity |
| Reviewed by | FDA during 510(k), De Novo or PMA review | Notified Body during technical documentation review |
| Key deliverables | Threat model, risk assessment, SBOM, testing, postmarket plan | Security risk management, IT security requirements, IFU information |
Why Medical Device Cybersecurity Matters
A compromised infusion pump, imaging system or diabetes app can deliver the wrong therapy, expose patient data or take a hospital service offline. Attacks on healthcare networks often reach devices that were never designed with security in mind. That is why reviewers now ask how each threat could lead to patient harm, how you control it, and how you will respond when a new vulnerability is published years after launch. Strong medical device cybersecurity also shortens review time, because a complete, traceable file avoids the most common Additional Information requests and Notified Body findings.
FDA Medical Device Cybersecurity Requirements
Section 524B applies to “cyber devices”: devices that include software, can connect to the internet and could be vulnerable to cyber threats. FDA reads this broadly, so most devices with software and any form of connectivity are in scope. A premarket submission for a cyber device must include:
- A plan to monitor, identify and address postmarket vulnerabilities and exploits, including coordinated vulnerability disclosure
- Processes and procedures that give reasonable assurance of cybersecurity, with regular and urgent updates and patches
- A software bill of materials (SBOM) covering commercial, open-source and off-the-shelf components
Which Devices Count as Cyber Devices?
In practice, assume your device is a cyber device if it runs software or firmware and has any data path to the outside world: Wi-Fi, Bluetooth, cellular, Ethernet, USB, removable media or a connection through a companion app or cloud service. Devices without internet access can still be in scope when they connect to something that is. If you conclude the device is not a cyber device, document the rationale, because FDA will ask for it.
FDA Premarket Cybersecurity Guidance Timeline
| Date | Document | What changed |
|---|---|---|
| September 2023 | Premarket cybersecurity guidance (final) | Replaced the 2014 guidance; introduced the secure product development framework approach |
| June 2025 | Updated final guidance | Added the section 524B cyber device section; superseded the 2023 version |
| February 2026 | Revised guidance | Aligned with the Quality Management System Regulation (QMSR) and ISO 13485 references |
What FDA Expects in the Submission
- Secure product development framework (SPDF) integrated in your quality system
- Threat model and cybersecurity risk assessment linked to patient harm
- Security architecture views and the security controls you implemented
- SBOM with support and end-of-life information, and an assessment of known vulnerabilities
- Security testing: penetration testing, fuzzing, vulnerability scanning and traceability to requirements
- Cybersecurity labeling for users and a cybersecurity management plan
Read the current documents on FDA’s cybersecurity page. For software-only products, see how this fits in the SaMD 510k process and the full FDA 510(k) submission.
EU MDR and IVDR Cybersecurity Requirements
EU MDR and IVDR do not have a separate cybersecurity article. The obligations sit in the General Safety and Performance Requirements of Annex I, interpreted by MDCG 2019-16. Your Notified Body will look for evidence against these sections:
| Requirement | MDR Annex I | IVDR Annex I |
|---|---|---|
| Software interaction with the IT environment | 14.2(d) | 13.2(d) |
| Software developed to the state of the art, including information security | 17.2 | 16.2 |
| Minimum IT hardware, network and security requirements | 17.4 | 16.4 |
| Protection against unauthorised access | 18.8 | — |
| Minimum IT requirements in the instructions for use | 23.4(ab) | 20.4.1(ah) |
Joint Responsibility and the Operating Environment
MDCG 2019-16 describes joint responsibility: the manufacturer carries the legal obligations, while hospitals, integrators and users each have expectations. You must state the minimum IT security your device assumes in its operating environment, and the device should not rely on that environment to compensate for its own weaknesses.
What Notified Bodies Check
- A security risk management process integrated with ISO 14971
- Secure development activities, typically against IEC 81001-5-1
- Security requirements, verification and penetration test evidence
- Minimum IT environment requirements and security information in the instructions for use
- Postmarket processes for vulnerability monitoring and security updates
Medical devices and IVDs regulated under MDR and IVDR are outside the scope of the EU Cyber Resilience Act. Build the evidence into your technical file or IVDR technical documentation.
Which Cybersecurity Standards Apply to Medical Devices?
These are the standards most often used to show state-of-the-art medical device cybersecurity to FDA and Notified Bodies:
| Standard | What it covers |
|---|---|
| IEC 81001-5-1 | Security activities across the health software lifecycle, extending IEC 62304 |
| IEC 62304 | Medical device software lifecycle processes |
| ISO 14971 | Risk management, with security risks feeding safety risk analysis |
| ANSI/AAMI SW96 and AAMI TIR57 | Security risk management for medical device manufacturers |
| IEC TR 60601-4-5 | Security capabilities for networked medical electrical equipment |
| UL 2900-2-1 | Security testing for network-connectable healthcare components |
| IMDRF cybersecurity principles | International principles and practices, including legacy devices |
IEC 81001-5-1 is usually the backbone. It adds security activities to each IEC 62304 lifecycle stage: security requirements, secure design and coding, security verification, vulnerability handling and secure release. Manufacturers who already follow IEC 62304 can extend their existing procedures rather than build a separate program, which keeps security evidence inside the same design history file that reviewers already read.
Our Medical Device Cybersecurity Consulting Services
We combine regulatory affairs and security engineering, so every deliverable is written for the reviewer who will read it.
Threat modeling and risk assessment
Assets, attack surfaces and threats, scored and linked to patient harm in your risk file.
SBOM generation and management
Machine-readable SBOMs with known-vulnerability tracking and end-of-support data.
Penetration testing
Penetration testing, fuzzing and vulnerability scanning for connected and wireless devices.
FDA submission package
524B content for 510(k), De Novo or PMA, plus Pre-Submission support.
EU MDR and IVDR documentation
GSPR evidence aligned with MDCG 2019-16 and IEC 81001-5-1 for your Notified Body.
Postmarket and CVD
Vulnerability monitoring, incident response and a coordinated disclosure process.
Legacy device assessment
Risk review and remediation roadmap for devices already on the market.
Software regulatory support
Integration with software CE marking and SaMD projects.
5-Step Medical Device Cybersecurity Process
This is how we take a connected device from first review to a submission-ready medical device cybersecurity file.
- Gap assessmentReview existing documents against FDA 524B and MDR or IVDR expectations, and list the gaps that would block submission.
- Threat modeling and riskBuild the threat model and cybersecurity risk assessment and link them to safety risks.
- SBOM and technical fileGenerate the SBOM and write the security architecture, controls and labeling sections.
- Testing and validationRun penetration, fuzz and vulnerability testing with results traced to security requirements.
- Submission and postmarketAssemble the FDA package or Notified Body file and set up vulnerability monitoring and CVD.
How Long Does It Take?
For a typical connected device, the gap assessment and first threat model take a few weeks. Penetration testing and documentation follow over the next one to three months, depending on how many interfaces the device has and how mature your software lifecycle already is. Starting before design freeze avoids rework.
Medical Device Cybersecurity Compliance Roadmap
The roadmap below shows how core principles, the secure product development framework, premarket requirements, section 524B obligations and labeling build on each other until the file is ready for FDA or a Notified Body. In short:
- Core principles and QMSTreat cybersecurity as device safety and build it into ISO 13485 and QMSR processes, with confidentiality, integrity, authenticity and updatability as objectives.
- Secure product development frameworkApply security across the lifecycle, keep security risk separate from but linked to ISO 14971 safety risk, and start threat modeling early.
- Premarket submission requirementsProvide security architecture views, documentation scaled to risk, and verification and validation testing of every security control.
- Section 524B cyber device requirementsConfirm whether the device is a cyber device, then supply the SBOM and the postmarket cybersecurity plan.
- Labeling and transparencyTell users how to operate the device securely and how it will be decommissioned safely at end of life.
Postmarket Cybersecurity and Legacy Devices
After FDA clearance or CE marking, manufacturers must keep monitoring, assessing and fixing vulnerabilities for the whole supported life of the device. Section 524B makes the postmarket vulnerability plan part of the 510(k) itself, and EU MDR expects security updates to be handled through post-market surveillance and vigilance. In practice, medical device cybersecurity after launch is a routine process, not a one-off project: new vulnerabilities appear in operating systems, open-source libraries and wireless protocols every week, and each one has to be checked against the SBOM and the patient-harm analysis. A working postmarket process covers:
- Monitor vulnerability sources against the SBOM and assess each finding for patient risk
- Run a coordinated vulnerability disclosure (CVD) process for researchers and customers
- Release routine updates on a planned cycle and urgent patches for critical vulnerabilities
- Feed findings into post-market surveillance and, where needed, vigilance reporting
- Assess legacy devices that predate current expectations and agree remediation or end-of-support communication
Common Cybersecurity Deficiencies in Device Submissions
These gaps cause most FDA questions and Notified Body findings we see on medical device cybersecurity files:
- Threat model with no link to patient harm or the safety risk file
- SBOM that is incomplete, not machine-readable or missing end-of-support dates
- Penetration test report with no traceability to security requirements
- Security controls claimed in the design but never verified
- Instructions for use with no minimum IT security requirements
- No postmarket vulnerability plan or CVD process
- Cybersecurity treated as an IT document outside the quality system
Why I3CGLOBAL?
We have worked on FDA 510(k), EU MDR and IVDR CE marking, ISO 13485 and UKCA projects for manufacturers worldwide, with teams in the USA, UK, India, Germany, Portugal, South Korea and Malaysia. Unlike IT-only security vendors, our cybersecurity work sits with the regulatory and technical file teams. See our FDA 510(k) consultants and EU MDR consultants.
Work with I3CGLOBAL
Get a Free Medical Device Cybersecurity Gap Assessment
Send us your device description and architecture, and we will tell you what is missing for FDA section 524B and EU MDR or IVDR, and how long it will take to close the gaps.
- Gap report against FDA and MDR
- Threat model and SBOM plan
- Testing and submission roadmap
Request a cybersecurity proposal
Tell us about your device, connectivity and target markets.
FAQs
Medical Device Cybersecurity: Frequently Asked Questions
What is medical device cybersecurity?
Medical device cybersecurity is the protection of a device, its software and data against unauthorised access, modification or disruption that could harm patients. FDA and EU regulators treat it as part of device safety.
Is cybersecurity documentation mandatory for an FDA 510(k)?
Yes, for cyber devices. Since 29 March 2023, section 524B requires a postmarket vulnerability plan, cybersecurity processes and an SBOM in 510(k), De Novo and PMA submissions for devices with software that can connect and could be vulnerable.
What does EU MDR require for cybersecurity?
EU MDR requires compliance with Annex I sections such as 17.2, 17.4, 18.8 and 23.4(ab), covering secure development, minimum IT requirements, protection against unauthorised access and IT information in the instructions for use. IVDR has equivalent sections.
What is an SBOM and is it required?
A software bill of materials is a list of all commercial, open-source and off-the-shelf software components in a device. It is required for FDA cyber device submissions and increasingly expected by Notified Bodies.
Which standards apply to medical device cybersecurity?
Commonly used standards include IEC 81001-5-1, IEC 62304, ISO 14971, ANSI/AAMI SW96, AAMI TIR57, IEC TR 60601-4-5 and UL 2900-2-1, alongside FDA guidance and MDCG 2019-16.
Does the EU Cyber Resilience Act apply to medical devices?
No. Products regulated under EU MDR and IVDR are outside the scope of the Cyber Resilience Act; their cybersecurity is covered by the device regulations.
Do legacy devices need a cybersecurity assessment?
Usually yes. Manufacturers are expected to assess current risks for devices already on the market and act through updates, labeling or documented risk communication.
How long does a cybersecurity gap assessment take?
A gap assessment and first threat model usually take a few weeks, depending on device complexity. Testing and documentation then run in parallel with the regulatory timeline.