On this page
In this issue
FDA & US regulatory
Letters, guidance, enforcement
CISA KEV & CVEs
Vulnerabilities in your SBOM
Standards & international
AAMI, ISO, IEC, EU MDCG
What to do this week
Concrete actions for security leads
Key Takeaways
- RHEL 7 Extended Life Support officially concluded on June 30, 2026.
- We recommend specific documentation for devices still running RHEL 7.
- Postmarket files must now include either a migration plan or a formal justification for compensating controls.
- Absence of security errata for legacy systems necessitates a higher frequency of manual vulnerability monitoring.
- Section 524B and the FDA's February 3, 2026 premarket cybersecurity guidance both rely on an accurate software bill of materials (SBOM). Our advice, not an FDA rule: check the SBOMs for older devices too.
The primary focus for manufacturers this period is managing the end of support for legacy operating systems in their device fleets. With the expiration of Red Hat Enterprise Linux (RHEL) 7 Extended Life Support, organizations must prioritize documenting compensating controls or migration paths to maintain regulatory compliance.
While the summer months typically bring a slower pace of new regulatory releases, the last 90 days have highlighted critical maintenance milestones for medical device manufacturers. The shift away from legacy software support remains a dominant theme, requiring security leads to verify that their postmarket files accurately reflect the current risk posture of their deployed devices.
As we look across the recent regulatory landscape, the emphasis has shifted from new guidance to the execution of existing lifecycle requirements. Manufacturers are expected to demonstrate active monitoring and mitigation strategies for vulnerabilities that emerge as third party software reaches its final end of life stages.
In this brief
- RHEL 7 Extended Life Support Conclusion
- Managing Legacy Software Risks
- What to do this week
- How Blue Goat Cyber Helps
- FAQ
Why This Matters
For device manufacturers, the end of support for a foundational operating system creates a direct compliance gap. Relying on an unsupported OS without documented mitigations leaves a gap in your postmarket risk management, and we advise closing it.
RHEL 7 Extended Life Support Conclusion
Red Hat Enterprise Linux 7 Extended Life Support (ELS) reached its final end of support date on June 30, 2026.
Managing Legacy Software Risks
Managing legacy software is not just a technical hurdle but a regulatory necessity.
What to do this week
- Conduct a full inventory of all deployed and currently shipping devices to identify those running RHEL 7 or related legacy distributions.
- Draft a formal compensating-controls memo for each legacy device family to be included in the postmarket security file.
- Review existing migration schedules to ensure that software updates for older hardware are prioritized before the end of the fiscal year.
How Blue Goat Cyber Helps
Blue Goat Cyber assists medical device manufacturers in navigating complex regulatory requirements and securing their technology stacks. Our team provides specialized services including penetration testing and risk assessments to ensure your devices meet current security standards. For more information on our approach, visit our services page.
FAQ
What happens to RHEL 7 devices after June 30, 2026?
They no longer receive security updates, requiring manufacturers to implement compensating controls.
Should we have a migration plan for legacy OS devices?
We recommend it: keep either a migration path or a documented justification for staying on an older OS.
Where can I find more updates on regulatory changes?
You can follow recent developments at the Goat's Weekly news page.
Get the next issue
To stay updated on the latest medical device security requirements, subscribe to Goat's Weekly.