Decide whether a fielded vulnerability is controlled or uncontrolled under the FDA postmarket cybersecurity framework. Six questions, FDA-aligned verdict, and the next actions.
Reviewed by
Christian Espinosa
Founder & CEO, Blue Goat Cyber
1. Is the vulnerable code reachable in the deployed device configuration?
Reachability = an attacker can actually invoke the affected code path given how the device ships and is used.
2. If exploited, what is the worst credible patient-safety consequence (ISO 14971)?
3. What is the public exploit signal today?
Use CISA KEV, EPSS, public PoC, and active-exploitation reporting.
4. What access does an attacker need?
5. What compensating controls are in place right now?
6. Can you detect exploitation attempts in fielded devices?
What you'll see after you submit
Common misconceptions
Myth: A high CVSS score means uncontrolled risk.
Reality: CVSS measures the vulnerability, not your residual risk. A 9.8 in unreachable code with secure boot can be controlled; a 6.5 in a network-reachable, KEV-listed library may not be.
Myth: If we patched it, it was never uncontrolled.
Reality: Classification is based on the state at discovery, not after remediation. Document the controlled/uncontrolled decision at the moment you learned about the vulnerability.
Myth: Uncontrolled risk always means a recall.
Reality: It triggers customer notification, mitigation, and 21 CFR 806 evaluation - which may or may not be a recall depending on the correction.
References & further reading
Set monitoring, patch, and FDA-reporting SLAs that match reviewer expectations.
Read Postmarket cadence calculatorDraft the VEX statement that backs your controlled-risk call.
Read SBOM Diff & VEX DrafterWe run the controlled/uncontrolled decision continuously, not annually.
Read Postmarket SBOM & VEX monitoringDefinition, FDA framing, and worked example.
Read Glossary: Controlled vs Uncontrolled Risk