What FDA is asking for, and what to do about it.

34 articles, newest first

1. Jul 31, 2026

   How to Choose a Medical Device Penetration Testing Vendor

   Seven questions that separate medical device penetration testing vendors from generic IT security firms, and the red flags that predict FDA deficiencies.

2. Jul 31, 2026

   What Goes in a Medical Device Penetration Test Report for FDA

   The sections FDA reviewers expect in a medical device penetration test report: scope, methodology, findings with CVSS scores, anomalies, and how it ties to your risk assessment.

3. Jul 31, 2026

   How Much Does Medical Device Penetration Testing Cost?

   Medical device penetration testing typically runs $15,000 to $75,000+. The drivers: interface count, device complexity, FDA reporting depth, and re-testing.

4. Apr 15, 2026

   Medical Device Security Testing Guide: What to Test, When to Test It, and What FDA Expects

   A practical medical device security testing guide: architecture reviews, code review, fuzzing, penetration testing, and FDA-ready evidence.

5. Mar 31, 2026

   Congress Just Advanced a Healthcare Cybersecurity Bill. What It Means for Medical Device Companies.

   The Health Care Cybersecurity and Resiliency Act just cleared the Senate HELP Committee. For medical device manufacturers, this is not a drill.

6. Mar 25, 2026

   What the Stryker Attack Actually Means for Medical Device Companies

   The Stryker wiper attack exposed the gap between FDA compliance and operational resilience. Here's what medical device companies should actually do about it.

7. Mar 24, 2026

   The 5 Riskiest Medical Devices in 2026, According to New Research

   Forescout just published its 2026 Riskiest Devices report, and for anyone working in medical device security, the IoMT section is worth reading carefully.

8. Mar 4, 2026

   SBOM Generation for Medical Device Software: Practical Setup by Stack

   Practical SBOM generation for medical device software across common stacks, with validation and quality gates for FDA submission.

9. Feb 24, 2026

   FDA's 3rd Cybersecurity Guidance in 3 Years: What Actually Changed?

   FDA released its 3rd cybersecurity guidance in 3 years. The update swaps QSR for QMSR and leaves the 14 required documents untouched. Here is what changed.

10. Jan 8, 2026

    Medical Device Encryption for Non-Engineers

    A plain-language guide to medical device encryption for QA and regulatory teams: symmetric vs asymmetric, key management, and quantum implications.

11. Nov 24, 2025

    Software Design Specification for IEC 62304 and FDA Compliance

    How to write a Software Design Specification that meets IEC 62304 clause 5.4 and FDA expectations, with checklists, examples, and common pitfalls.

12. Oct 28, 2025

    IEC 62304 to FDA eSTAR: A Software Documentation Guide

    Map IEC 62304 processes to FDA eSTAR requirements. Complete guide to 10 required software documents for medical device submissions with examples.

13. Sep 4, 2025

    Balancing Security Controls with Usability in Medical Devices: A Risk-Based Approach

    How medical device teams balance cybersecurity controls with clinical usability using risk-based design, collaboration, and FDA-aligned documentation.

14. Aug 20, 2025

    12 Essential FDA Cybersecurity Risk Assessment Rules

    Twelve rules that decide whether your FDA cybersecurity risk assessment satisfies a reviewer or triggers an AI request, each mapped to the guidance.

15. Aug 6, 2025

    Documentation Overload: The 24+ Documents FDA Requires for Software and Cybersecurity

    Catalogs the software and cybersecurity documents FDA expects in eSTAR submissions and offers guidance on organizing evidence for reviewers.

16. Jul 22, 2025

    STRIDE for Medical Devices: A Complete Threat Modeling Framework

    Shows how to use the STRIDE framework to categorize threats, map mitigations, and meet FDA cybersecurity expectations.

17. Jul 17, 2025

    How to Create FDA-Compliant Cybersecurity Traceability Matrices in 2025

    Details how to build cybersecurity traceability matrices that connect threats, controls, and verification evidence for modern FDA submissions.

18. Jul 9, 2025

    A Guide to Post-Market Cybersecurity Management

    Covers the monitoring, vulnerability response, and legacy planning manufacturers need to keep medical devices cybersecure after FDA clearance.

19. Jun 25, 2025

    SPDF vs IEC 62304: Avoid Costly Documentation Mistakes

    Clarifies how FDA's Secure Product Development Framework complements IEC 62304 and what dual documentation packages reviewers expect.

20. Jun 18, 2025

    Security Architecture as the Foundation of your Medical Device

    Explains why secure architecture decisions early in development prevent costly rework and position medical devices for smoother FDA cybersecurity reviews.

21. Apr 26, 2025

    Medical Device Risk Assessment using CVSS

    Explore the innovative application of the Common Vulnerability Scoring System (CVSS) in medical device risk assessment.

22. Feb 20, 2025

    Secure Your Medical Device with Cybersecurity Controls

    How to choose, build, and verify cybersecurity controls for medical devices, with each control traced to a specific threat in your model.

23. Feb 19, 2025

    How to Conduct Medical Device Penetration Testing

    How to conduct medical device penetration testing: scoping, black, white, and grey box approaches, the five test phases, and FDA-ready reporting.

24. Feb 19, 2025

    How to Implement Secure Software Development Lifecycle (SDLC) for Medical Devices

    Secure SDLC for medical devices: which security activity belongs in each stage, the FDA artifact it produces, and common submission failures.

25. Feb 18, 2025

    Master Data Flow Diagrams for Medical Devices: 4 Critical Components

    How to create data flow diagrams for medical devices: the four core components, steps to build one, and how DFDs feed threat modeling for FDA.

26. Feb 18, 2025

    How to Perform security code review

    Learn how to perform a security code review: preparation, manual and automated techniques, and how to catch vulnerabilities before code ships.

27. Feb 14, 2025

    Medical Device Security Architecture: How to Build the View FDA Expects

    How to build the medical device security architecture view FDA reviewers expect, step by step, aligned with AAMI SW96 and TIR57.

28. Feb 11, 2025

    How to Establish Patch Management and Security Update Process

    Provides a step-by-step playbook for building an FDA-aligned patch and security update program for connected devices.

29. Feb 10, 2025

    A Comprehensive Guide to Threat Modeling for Cloud-Connected Medical Devices

    Guides teams through threat modeling a cloud-connected device using FDA's 2023 cybersecurity guidance alongside AAMI TIR57 and SW96.

30. Jan 31, 2025

    FDA Cybersecurity Requirements for Medical Devices with Software

    What FDA actually expects in the cybersecurity package for a software-based medical device, mapped to where each artifact lives in your submission.

31. Jul 29, 2024

    5 reasons FDA will refuse your 510(k) application due to cybersecurity deficiencies

    Outlines five cybersecurity gaps that now trigger FDA refusal-to-accept decisions for 510(k) submissions and how to close them.

32. Jul 18, 2024

    Ensuring Secure Software Updates for Medical Devices

    The update path is privileged code execution shipped to every device. Here is the architecture that keeps medical device software updates secure.

33. Jul 18, 2024

    New Cybersecurity Regulations Make Remote Software Updates Practically Mandatory

    Makes the case that remote update capability is now essential under FDA cybersecurity rules and explains how to implement it safely.

34. Jul 18, 2024

    What Information FDA is Expecting for Cyber Devices?

    Breaks down the cybersecurity evidence FDA expects in submissions for software-enabled medical devices, from threat models to testing reports.