FDA expects cybersecurity risk to be assessed in its own right and then integrated into the ISO 14971 safety risk file - not collapsed into it. A 'missing cybersecurity risk assessment' deficiency typically means one of two things: the submission contains an ISO 14971 risk file that mentions cybersecurity hazards but no separate AAMI TIR57-aligned security risk analysis, or the security risk analysis exists but does not explain how exploitability and patient harm were combined to produce the residual risk values that drive the controls and verification.
Paraphrased patterns from real deficiency letters. Not verbatim FDA quotes.
The submission does not contain a cybersecurity risk assessment that is distinct from, but integrated with, the device's safety risk management file. Provide a security risk assessment consistent with AAMI TIR57 and demonstrate how it informs the ISO 14971 risk management file.
The methodology used to score cybersecurity risk is not described. Provide the rationale for the chosen exploitability and impact scales and how they are combined to determine residual risk.
Several threats identified in the threat model do not appear to be carried through to the cybersecurity risk assessment. Provide updated documentation that traces each identified threat to a corresponding risk evaluation and risk control.
ISO 14971 was written for hazards that arise from the device itself, where probability is largely a function of failure modes, use error, and environmental conditions. Cybersecurity risks have a different probability driver: an intentional, adaptive adversary. AAMI TIR57 exists precisely because you cannot estimate the probability of an exploit using the same techniques you use to estimate the probability of a component failure. FDA reviewers expect to see both methodologies acknowledged: a security-specific assessment that uses exploitability, and an integration mapping that translates security exploit scenarios into hazardous situations evaluated under ISO 14971. Most deficiencies in this area come from teams that picked one methodology and tried to do both jobs with it.
Reviewers do not want to take the residual-risk verdict on faith. The risk assessment should make the math visible: the exploitability score and its rationale, the patient-harm severity from the safety file, the combination rule, the resulting raw risk, the control(s) applied, and the residual risk. Submissions that show this derivation in a table - even a simple one - almost never draw a methodology deficiency. Submissions that present a one-word verdict almost always do.
Already responding to this deficiency?
Our deficiency response engagement rebuilds the underlying artifact and produces a reviewer-ready response narrative.
FDA Cybersecurity Deficiency Response serviceBring us the letter. We will map a clean response and rebuild the underlying artifact to FDA 2026 expectations.
