MEDev.AI
0
Knowledge Center
Standards
Regulations
Tools
AI Tools
Analysis
Professional Development
Future Generations
Contact Us
--:--:-- --
--- --, ----
Session
0s
MEDev.AI
0
Knowledge Center
Standards
Regulations
Tools
AI Tools
Analysis
Professional Development
Future Generations
Contact Us
--:--:-- --
--- --, ----
Session
0s
MEDev.AI
0
Knowledge Center
Standards
Regulations
Tools
AI Tools
Analysis
Professional Development
Future Generations
Contact Us
--:--:-- --
--- --, ----
Session
0s
Back to Tools

Cyber Device Classification

Determine if your medical device is a "cyber device" per FDA regulations and understand cybersecurity requirements

Important Regulatory Update - September 2023

FDA's "Cybersecurity in Medical Devices" guidance establishes mandatory requirements for "cyber devices" under FD&C Act Section 524B. Premarket submissions must include comprehensive cybersecurity documentation.

Cyber Device Definition

A cyber device must meet ALL three criteria: (1) includes software, (2) can connect to internet, and (3) has cyber-vulnerable characteristics. This is a statutory definition from the FD&C Act.

SBOM Requirement

Software Bill of Materials must include all commercial, open-source, and off-the-shelf components. Machine-readable format (SPDX/CycloneDX) required with vulnerability tracking.

Risk-Based Tiers

FDA uses two tiers: Standard (lower risk) and Enhanced (higher risk). Enhanced tier requires penetration testing, detailed threat modeling, and more comprehensive documentation.

FD&C Act Section 524B Requirements

Premarket Requirements (524B(b))

  • Submit plan to monitor, identify, and address postmarket cybersecurity vulnerabilities
  • Design, develop, and maintain processes to ensure device security
  • Provide Software Bill of Materials (SBOM)
  • Submit evidence of compliance with cybersecurity requirements

Postmarket Requirements

  • Monitor and identify new vulnerabilities in a timely manner
  • Deploy security patches and updates to address vulnerabilities
  • Maintain coordinated vulnerability disclosure (CVD) process
  • Report cybersecurity issues per MDR requirements when applicable

Premarket Submission Documentation

Standard Tier Documentation

  • • Threat model summary
  • • Security risk assessment
  • • Security requirements specification
  • • Cybersecurity testing summary
  • • Update/patch mechanism description
  • • SBOM (machine-readable)
  • • Vulnerability disclosure plan

Enhanced Tier Documentation

  • • All Standard tier documentation PLUS:
  • • Detailed threat model with attack trees
  • • Security architecture documentation
  • • Penetration testing results
  • • Security requirements traceability
  • • Cryptographic implementation details
  • • Third-party security assessment (if applicable)
  • • Interface security analysis

Software Bill of Materials (SBOM) Requirements

Format Requirements

  • • Machine-readable format
  • • SPDX or CycloneDX preferred
  • • Include component versions
  • • Dependency relationships

Component Coverage

  • • Commercial software
  • • Open-source components
  • • Off-the-shelf (OTS) software
  • • Third-party libraries
  • • Operating systems

Vulnerability Tracking

  • • Known vulnerabilities per component
  • • CVE references
  • • Risk assessment for each
  • • Mitigation status

Recommended Security Controls

Authentication

  • • Multi-factor authentication
  • • Role-based access control
  • • Session management
  • • Password policies

Cryptography

  • • Data encryption (at rest/in transit)
  • • Secure key management
  • • Code signing
  • • Secure boot

Monitoring

  • • Audit logging
  • • Anomaly detection
  • • Integrity checking
  • • Event monitoring

Updates

  • • Secure update mechanism
  • • Rollback capability
  • • Update verification
  • • Remote patching

Related Standards & Guidance

IEC 81001-5-1

Health software cybersecurity lifecycle

IEC 62304

Medical device software lifecycle processes

ISO 14971

Risk management (including security risks)

FDA Premarket Guidance

Cybersecurity quality system considerations

FDA Postmarket Guidance

Managing cybersecurity post-release

FDA Cybersecurity FAQs

Common questions answered

Common Device Scenarios

CYBER DEVICE - Enhanced Tier

Infusion pump with Wi-Fi connectivity, remote monitoring app, and cloud-based dosing database.

Requires: Comprehensive threat model, penetration testing, detailed SBOM, security architecture review

CYBER DEVICE - Standard Tier

Diagnostic imaging workstation with network connectivity for PACS integration but no direct patient therapy.

Requires: Threat model summary, security testing, SBOM, vulnerability disclosure plan

NOT A CYBER DEVICE

Manual surgical instrument with no electronics. Standalone thermometer with no connectivity.

Standard cybersecurity requirements do not apply (but still consider general best practices if any software present)

Back to All Tools

Cyber Device Classification Tool

Determine if your device is a "cyber device" per FDA requirements

FDA Cyber Device Classification Decision Tree

Per FD&C Act Section 524B(c), a "cyber device" must meet ALL THREE criteria:

MEDICAL DEVICEIncludes softwareby sponsor?NONOT ACYBER DEVICEYESCan connect tointernet?NONOT ACYBER DEVICEYESCyber vulnerablecharacteristics?NONOT ACYBER DEVICEYESCYBER DEVICE524B appliesDETERMINE RISK TIERStandard vs Enhancedbased on patient riskLEGENDCurrent QuestionNot Cyber DeviceIs Cyber Device

Classification Assessment

Answer three questions to determine if your device is a "cyber device" under FDA regulations.

FDA Cybersecurity Guidance Reference

FD&C Act Section 524B - Cyber Device Definition

A "cyber device" is a device that: (1) includes software validated, installed, or authorized by the sponsor as a device or in a device; (2) has the ability to connect to the internet; and (3) contains any such technological characteristics validated, installed, or authorized by the sponsor that could be vulnerable to cybersecurity threats.

Premarket Cybersecurity Guidance

Quality System Considerations (Sept 2023)

FDA Cybersecurity Center

All cybersecurity resources

Important Disclaimer

This tool provides guidance based on FDA's 2023 cybersecurity guidance. Actual requirements may vary based on device characteristics, evolving FDA guidance, and specific submission types. Consult with cybersecurity professionals and regulatory experts for definitive guidance.