Monitoring & Patch Cadence Calculator

What teams usually get wrong

• Myth: Annual pen testing is fine for any device.

  Reality: Test timing should reflect device risk, changes, and emerging vulnerabilities. The FDA does not prescribe a universal annual or per-release penetration-test interval.

• Myth: FDA postmarket timelines only apply to recalls.

  Reality: 21 CFR 806.10 generally requires reporting within 10 working days after initiating an applicable correction or removal. Assess exemptions and the specific conditions in the 2016 guidance; its 30/60-day enforcement-discretion criteria are not blanket statutory patch deadlines.

• Myth: We monitor CVEs against our SBOM once a quarter.

  Reality: Set monitoring and triage based on device-specific risk and sources. A fixed quarterly review alone may miss urgent vulnerabilities; this tool cannot decide whether a cadence satisfies a submission.

• Myth: Patch validation is the same for all devices.

  Reality: Determine verification and validation evidence from the actual change, device function, and safety risks. Device class or cadence tier alone cannot select a sufficient test protocol or justify a rollout.

Primary sources behind this tool

1. 1Postmarket Management of Cybersecurity in Medical Devices (Dec 2016) - FDA
2. 221 CFR Part 806 - Reports of Corrections and Removals - U.S. Code of Federal Regulations
3. 3AAMI TIR97:2019 - Principles for Medical Device Security: Postmarket Risk Management - AAMI
4. 4CISA Known Exploited Vulnerabilities Catalog - CISA
5. 5FDA §524B Postmarket Obligations Summary - FDA