AAMI SW96 vs TIR57

When to use which

For any new FDA premarket submission planned under the Cybersecurity in Medical Devices final guidance (effective February 3, 2026), build the cybersecurity risk-management file against ANSI/AAMI SW96:2023. Map every threat in the threat model to a SW96 risk register entry and to a verification or mitigation artifact in the submission package.

Programs with mature, audited risk files written against AAMI TIR57 do not need to be rebuilt from scratch. Maintain TIR57 traceability and add a SW96 conformance overlay that demonstrates equivalence to reviewers - Blue Goat Cyber routinely produces this crosswalk as part of a deficiency-letter response.

What changes when you move from TIR57 to SW96

• Threat modeling becomes required, and each threat must link to an entry in the security risk register.
• Exploitability replaces probability. Security risk is scored on how easily a threat can be exploited, not on how likely it is to happen. Language like "unlikely" or "low probability" in a security risk file is a common reviewer flag.
• Traceability tightens. Each security control should trace to a threat, a risk entry and a test that shows it works.
• Security risk connects to safety risk. Where a security threat could cause patient harm, the security file feeds the ISO 14971 safety risk file instead of living on its own.

A practical migration checklist

1. Inventory where your procedures and risk files cite TIR57.
2. Update the security risk procedure to use exploitability scoring and require a threat model.
3. Re-score open risks with the new method and document why any ratings changed.
4. Add traceability from each control to its verification test.
5. Keep the TIR57 history for audit, with a crosswalk showing how it maps to SW96.