Monitoring & Patch Cadence Calculator

What teams usually get wrong

• Myth: Annual pen testing is fine for any device.

  Reality: FDA expects pen test cadence to scale with risk and connectivity. Internet-connected Class II/III with PHI typically warrants every release plus a yearly external test - not just annual.

• Myth: FDA postmarket timelines only apply to recalls.

  Reality: Uncontrolled cybersecurity risk (CVSS-style or otherwise) starts the 30-day customer communication and 60-day fix timelines, and a 21 CFR 806 report is due within 10 working days unless those timelines are met with ISAO membership. The threshold is impact, not the word 'recall.'

• Myth: We monitor CVEs against our SBOM once a quarter.

  Reality: Reviewer expectation is continuous monitoring with documented triage SLAs. Quarterly cadence is a deficiency for any internet-connected device.

• Myth: Patch validation is the same for all devices.

  Reality: Closed-loop or life-supporting devices need bench + simulated-clinical validation per patch; lower-risk SaMD can use staged rollout with telemetry. The cadence tool tells you which lane you're in.

Primary sources behind this tool

1. 1Postmarket Management of Cybersecurity in Medical Devices (Dec 2016) - FDA
2. 221 CFR Part 806 - Reports of Corrections and Removals - U.S. Code of Federal Regulations
3. 3AAMI TIR97:2019 - Principles for Medical Device Security: Postmarket Risk Management - AAMI
4. 4CISA Known Exploited Vulnerabilities Catalog - CISA
5. 5FDA §524B Postmarket Obligations Summary - FDA