Postmarket Vulnerability Disclosure & CVD Program Blueprint

Why this matters

The FDA's guidance provides nonbinding recommendations for postmarket planning. Section 524B(b)(1) requires a plan including CVD and related procedures for covered cyber-device submissions. Section 524B(b)(1) of the FD&C Act makes a 'plan to monitor, identify, and address postmarket cybersecurity vulnerabilities' a statutory submission requirement. This blueprint gives you the policy, the operating model, and the evidence reviewers and researchers expect.

Key takeaway: A CVD program is not a security.txt file. Reviewers, researchers, and hospital customers all want to see a policy, a working intake, real triage SLAs, and a track record of advisories - not just an email address.

Requirements and useful implementation references

• ISO/IEC 29147:2018 - Vulnerability disclosure (the external-facing process)
• ISO/IEC 30111:2019 - Vulnerability handling processes (the internal triage process)
• FDA 2026 final premarket guidance - postmarket plan content
• Section 524B(b)(1) of the FD&C Act - statutory disclosure plan requirement
• CISA Coordinated Vulnerability Disclosure Process - coordination with ICS-MEDICAL advisories

The eight pillars of a working CVD program

• Public VDP policy page (scope, safe harbor, channels, SLA commitments)
• Multiple intake channels (web form, security@, PGP key, optional bug bounty)
• Internal triage workflow tied to your QMS / CAPA system
• CVSS + clinical-impact scoring rubric (mapped to ISO 14971)
• Patch / mitigation development with manufacturer-owned verification and validation evidence
• Customer advisory + MDS2 update + CISA coordination
• Public CVE assignment via CNA (or via MITRE root)
• KPIs and continuous improvement loop

Illustrative internal triage and remediation targets

• Other numeric targets here are illustrative internal commitments, not FDA-prescribed deadlines. Justify them using device-specific risk and do not delay urgent action.
• Acknowledge intake within 3 business days
• Initial triage + reproduction within 10 business days
• Critical vulnerabilities that could cause uncontrolled risks: make updates and patches available as soon as possible out of cycle; communicate urgent mitigation advice promptly
• High (CVSS 7.0-8.9): patch in 90 days
• Medium / Low: bundled into next scheduled release with disclosure within 180 days

What's in the full PDF

• Drop-in CVD policy template with safe-harbor language
• Intake → triage → advisory workflow diagram
• CVSS + clinical-impact scoring rubric
• Customer advisory and CISA ICS-MEDICAL coordination templates
• Reviewer-ready evidence pack checklist + KPI dashboard