Dec 28, 2016·FDA · Final GuidanceActiveMedium impact
FDA postmarket cybersecurity guidance (2016)
The FDA's postmarket guidance describes how manufacturers should monitor, assess and fix cybersecurity vulnerabilities in devices already on the market, including when a fix needs to be reported to the FDA and when it does not.
What changed
- Separates controlled from uncontrolled risk to patient harm, which drives whether a vulnerability fix must be reported.
- Expects a vulnerability disclosure process and participation in an information sharing group.
Action for manufacturers
Keep a written postmarket plan that covers monitoring, risk assessment of new vulnerabilities, disclosure and patching. Section 524B now makes a postmarket plan part of the submission for cyber devices.