Which cybersecurity standard is actually mandatory for a medical device?

Only one item in the chain is law: Section 524B of the FD&C Act, which applies to cyber devices and requires a cybersecurity plan, an SBOM, a reasonable assurance argument, and postmarket monitoring and patching. ANSI/AAMI SW96:2023, IEC 81001-5-1, IEC 62304, and ISO 14971 are consensus standards. They are not statutes, but they are the bar FDA reviewers measure your evidence against, so deviating from them requires a written rationale you are prepared to defend.

How do SW96, 81001-5-1, 62304, and ISO 14971 fit together?

ISO 14971 is the risk management framework and supplies the severity scale. IEC 62304 is the software lifecycle the work happens inside. IEC 81001-5-1 adds the security activities to that lifecycle: threat modeling, secure design, secure coding, security testing, and vulnerability handling. ANSI/AAMI SW96:2023 is the method for expressing security risk in patient-harm terms, substituting exploitability for probability of occurrence. Section 524B sits above all of them as the statutory obligation the evidence satisfies.

My device has no internet connection. Does Section 524B still apply?

The cyber device definition turns on software plus the ability to connect to the internet plus technological characteristics vulnerable to cybersecurity threats. A device with no internet path may fall outside the definition, but that is a determination you document, not silence you keep. The February 3, 2026 final premarket guidance still expects a proportionate cybersecurity package, and local interfaces such as USB, serial, and service ports remain in scope for testing.

Does IEC 60601 count toward cybersecurity evidence?

No. The IEC 60601 family covers basic safety, essential performance, EMC, alarms, and usability, and contains no cybersecurity requirements. Its role in a security program is definitional: the essential performance established under 60601-1 and the applicable 60601-2-xx particular standard is what you use to score patient-harm severity in the SW96 security risk analysis.

What software safety class should I use under IEC 62304?

Class A means no injury or damage to health is possible, Class B means non-serious injury is possible, and Class C means death or serious injury is possible. Classify before external risk control measures, then justify any reduction with the specific hardware or system-level control that makes it valid. Life-sustaining and therapy-delivering devices generally start at Class C, and reviewers scrutinize down-classification arguments closely.

Do the EU requirements duplicate the FDA package?

The evidence overlaps heavily. EU MDR Annex I 17.2 requires software developed per state of the art including IT security, MDCG 2019-16 describes the expected documentation, and the Cyber Resilience Act adds vulnerability handling and reporting duties. Write the artifacts once and maintain a mapping table showing which artifact satisfies which requirement in each jurisdiction. The reporting timelines and the notified body review remain separate.

When in the program should this mapping be done?

Before design freeze. The standards chain determines which artifacts exist and which activities have to be evidenced across development, and most of them cannot be reconstructed after the fact. Teams that map late discover the threat model would have surfaced architectural changes at the point those changes are most expensive.

Interactive tool

Medical device cybersecurity standards mapper

Pick a device type and a use case. The tool maps your profile onto the chain that matters, FD&C Act Section 524B, ANSI/AAMI SW96:2023, IEC 81001-5-1, IEC 62304, and ISO 14971, and tells you what each one obligates for that specific profile.

Step 1 of 3. Nothing is sent anywhere; the map is generated in your browser.

1. What kind of device is it?

This sets the essential performance you inherit as harm criteria and the starting software safety class.

How to read the verdicts

Verdict	What it means for your file
Required	Binding for this profile. Missing evidence is a deficiency or a legal gap.
Expected	Not law, but the bar reviewers measure you against. Deviating needs a written rationale.
Conditional	Applies only under the condition noted. Document the decision either way.
Not applicable	Out of scope for this profile. Record why so the file shows it was considered.

Frequently asked questions

Common questions on which standards bind, which are expected, and how they connect.

Related tools and guides

Section 524B Applicability Checker for the formal cyber device determination.
SPDF Gap Checker to score your secure development framework against IEC 81001-5-1.
The MedTech Cybersecurity Standards Decoder for the narrative version of this map.
IEC 60601 and cybersecurity for why the 60601 family sets no security requirements.
Section 524B requirements explained for the statutory detail behind step one.