On this page
In this issue
FDA & US regulatory
Letters, guidance, enforcement
CISA KEV & CVEs
Vulnerabilities in your SBOM
Standards & international
AAMI, ISO, IEC, EU MDCG
What to do this week
Concrete actions for security leads
Key Takeaways
- Red Hat Enterprise Linux (RHEL) 7 Extended Life Support officially ended on June 30, 2024.
- Postmarket files for devices using RHEL 7 must now include a formal compensating-controls justification.
- The FDA reviewers are prioritizing migration plans for legacy systems in new premarket submissions.
- Security errata for RHEL 7 have ceased, increasing the risk of unpatched vulnerabilities in clinical environments.
- Inventory management of deployed assets is the first step in maintaining regulatory compliance this summer.
The primary focus for medical device manufacturers this quarter is the formal end of support for legacy Linux distributions and the resulting pressure on postmarket documentation. We recommend a compensating-controls memo or migration plan for any device still running Red Hat Enterprise Linux 7.
While the current week is quiet regarding new regulatory filings, the last 90 days have seen significant shifts in how the FDA views legacy operating systems. Manufacturers are moving from a grace period into a strict enforcement phase for postmarket cybersecurity management. This transition requires a detailed look at existing device fleets and their underlying software bills of materials.
In this brief
- The Shift in Legacy OS Support
- Formalizing Red Hat Enterprise Linux 7 Sunset Documentation
- Why This Matters
- What to do this week
- How Blue Goat Cyber Helps
- FAQ
Why This Matters
For device manufacturers, an unsupported operating system is no longer just a technical debt issue. It is a regulatory liability. Without security patches, we recommend documenting alternative security measures in the quality system.
The Shift in Legacy OS Support
Over the past several months, the industry has seen a tightening of expectations regarding software lifecycle management.
Formalizing Red Hat Enterprise Linux 7 Sunset Documentation
A critical milestone passed on June 30, 2026, when Red Hat Enterprise Linux (RHEL) 7 reached the end of its Extended Life Support (ELS) period.
What to do this week
- Conduct a full inventory of all active and legacy products to identify any instances of RHEL 7 or other EOL software.
- Draft a template for a compensating-controls memo that can be customized for specific device families.
- Schedule a meeting with the engineering team to review the migration roadmap for any remaining RHEL 7 systems.
How Blue Goat Cyber Helps
Blue Goat Cyber assists medical device manufacturers in navigating these regulatory shifts through detailed technical testing and documentation support. Our team helps draft compensating-controls memos and perform the supporting risk assessments. We help bridge the gap between technical security debt and regulatory requirements.
FAQ
What happens if I don't have a migration plan for RHEL 7?
The FDA may find your postmarket cybersecurity management insufficient during a routine audit or premarket review.
Are compensating-controls enough for a permanent solution?
No, they are generally viewed as a temporary measure while a manufacturer works toward a platform migration.
Where can I track other upcoming regulatory deadlines?
You can follow our regulatory tracker for the latest updates on medical device cybersecurity requirements.
Get the next issue
Sign up to receive the next Goat's Weekly recap at Goat's Weekly.