A dated, structured log of FDA, CISA, AAMI, EU, and supply-chain changes that move the cybersecurity bar - with what changed and what to do about it.
RHEL 7 ELS reaches end of support on 30 June 2026. Devices that still ship or service with RHEL 7 need a compensating-controls memo in their postmarket file.
A use-after-free in Linux kernel netfilter (CVE-2026-0511) was added to the Known Exploited Vulnerabilities catalog, affecting many embedded Linux device platforms.
CISA added a BLE pairing bypass affecting an embedded Bluetooth stack used across consumer and medical wearables to the Known Exploited Vulnerabilities catalog.
Draft amendment clarifies threat modeling traceability, security risk evaluation, and the relationship between SW96 and AAMI TIR57.
The FDA's February 3, 2026 final guidance distinguishes nonbinding cybersecurity evidence recommendations from Section 524B statutory duties. Covered cyber-device submissions require an SBOM; VEX is optional, and an SPDF is encouraged rather than mandated.
The September 2023 premarket cybersecurity guidance is superseded by the February 3, 2026 final guidance. Citing the 2023 document in new submissions is now a stale reference.
The QMSR formally aligns 21 CFR Part 820 with ISO 13485:2016. Cybersecurity design controls, risk management, and supplier controls must now be documented under the harmonized framework.
1.6.1 errata clarifies how to express 'not_affected' justifications and how VEX statements should reference SBOM components by bom-ref or PURL.
Organizations still certified to ISO/IEC 27001:2013 lost certification on 31 October 2025. Hospitals expect the 2022 control set (including A.8 secure development, A.5.7 threat intelligence) in procurement.
CISA expanded the Secure by Design pledge so signatories are expected to publish VEX statements alongside SBOMs for shipped products.
Revised MDCG cybersecurity guidance details security risk management, IT environment assumptions, and basic UDI/postmarket cybersecurity expectations for Notified Body review.
Health Industry Cybersecurity Practices (HICP) 2025 refresh expands medical device practices and adds AI-specific considerations, raising the bar hospitals use during vendor risk reviews.
This draft covers lifecycle management and what to include in marketing submissions for AI-enabled device software, including a section on cybersecurity risks specific to AI, such as tampered training data and attacks on model inputs.
Final PCCP guidance lets manufacturers pre-authorize specified modifications to AI/ML-enabled device software functions without a new submission, provided cybersecurity impacts are scoped up front.
NIST SP 800-216 finalizes recommendations for federal vulnerability disclosure programs. While federal in scope, MedTech CVD programs are increasingly being benchmarked against it.
SPDX 3.0 introduces profiles (Software, Security, AI, Dataset) that align directly with SaMD and PCCP cybersecurity expectations.
In March 2024 the FDA published a draft explaining how it reads Section 524B, including what counts as a cyber device. That content has since been brought into the final premarket cybersecurity guidance.
CSF 2.0 adds the Govern function and broadens scope beyond critical infrastructure, becoming the de facto baseline hospitals reference in MDS2 / HSCC procurement questionnaires.
This guidance sets out the software documentation the FDA expects in a premarket submission, using two levels (Basic and Enhanced) based on risk. It sits alongside the cybersecurity guidance, which covers the security content.
Section 524B (Omnibus 2023) made cybersecurity submission content mandatory for cyber devices. The FDA has issued Refuse to Accept decisions for non-compliant submissions since October 2023.
When Section 524B took effect, the FDA said it would not refuse submissions for missing 524B content until October 1, 2023, and would work with sponsors during review instead. After that date, submissions missing the required cybersecurity content could be refused.
Spotted something we missed? Email info@bluegoatcyber.com with a link and we'll add it.
30-minute strategy session. No cost, no commitment - just answers from people who've supported 275+ FDA submissions, with zero cybersecurity rejections.
