Security Metrics and Continuous Improvement

Measure your post-market program with a small set of indicators: time to discover, assess, and patch vulnerabilities, incident detection and resolution times, and program health measures like SBOM accuracy and patch deployment success. Review them monthly for operations, quarterly for trends, and annually for strategy.

5.10.1 Key Performance Indicators

Track metrics that matter:

Vulnerability Management:

• Time to discover
• Time to assess
• Time to patch
• Deployment rate
• Reoccurrence rate

Incident Response:

• Detection time
• Response time
• Resolution time
• Impact scope
• Recovery time

Program Health:

• SBOM accuracy
• Monitoring coverage
• Patch deployment success
• Customer satisfaction
• Researcher relationships

5.10.2 Creating Dashboards

Visualize your security posture:

pie title Vulnerability Status
    "Patched" : 145
    "Mitigated" : 23
    "Accepted" : 12
    "In Progress" : 8

xychart-beta
    title "Mean Time to Patch (Days)"
    x-axis [Q1, Q2, Q3, Q4]
    y-axis "Days" 0 --> 60
    bar [45, 38, 32, 28]
    line [30, 30, 30, 30]

5.10.3 Regular Reviews

Schedule periodic assessments:

Monthly:

• Vulnerability statistics
• Patch deployment status
• Incident metrics
• Customer feedback

Quarterly:

• Program effectiveness
• Process improvements
• Resource adequacy
• Trend analysis

Annually:

• Strategic review
• Capability assessment
• Benchmark comparison
• Program evolution

Sources

Primary documents for the topics in this section:

1. FDA premarket cybersecurity guidance, Section V.A.4 Third-Party Software Components and SBOM, FDA, February 3, 2026.
2. FDA premarket cybersecurity guidance, Section V.A.6 TPLC Security Risk Management (measures and metrics), FDA, February 3, 2026.
3. Postmarket Management of Cybersecurity in Medical Devices, FDA, December 28, 2016.