Regulatory History and Framework

This chapter traces the evolution of medical device cybersecurity regulation from early FDA guidance through current legal requirements, providing the regulatory context needed for compliance.

Medical device cybersecurity went from an unregulated gray area to a legal mandate in about a decade, and this chapter explains how that happened and what it means for anyone bringing a device to market. It starts with the conditions that forced FDA's hand: connected devices multiplying in hospitals, researchers demonstrating real attacks on insulin pumps and pacemakers, and manufacturers themselves asking for clear expectations. From there it walks through each phase of FDA's response, beginning with the 2014 premarket guidance, then the 2016 postmarket guidance, then Section 524B of the FD&C Act, which made cybersecurity legally mandatory for "cyber devices," and finally the current premarket guidance with its Secure Product Development Framework.

The chapter then sorts out what's actually required by law versus what FDA "recommends" but expects in practice. That distinction trips up a lot of manufacturers, since guidance documents are technically nonbinding while missing documentation still triggers deficiency letters and clearance delays. There's also a tour of the standards that do the heavy lifting in real submissions: AAMI SW96 for security risk management, ISO 14971, IEC 62304, IEC 62443, ISO 81001-5-1, and the NIST and FIPS references FDA reviewers look for.

Later sections cover international requirements (IMDRF guidance, the EU MDR, and the approaches taken by Canada, Japan, and Australia), industry tools like the Joint Security Plan and MITRE's CVSS rubric for medical devices, and a practical sequence for building a regulatory strategy: classify your device, identify applicable requirements, run a gap analysis, and plan the work by risk. By the end you should be able to tell which requirements apply to your device, which documents belong in your submission, and where the rules are headed next.

Sources

Primary documents named in this section:

1. Postmarket Management of Cybersecurity in Medical Devices, FDA, December 28, 2016.
2. 21 U.S.C. 360n-2, Ensuring cybersecurity of devices (Section 524B of the FD&C Act), Office of the Law Revision Counsel.
3. Cybersecurity in Medical Devices: Frequently Asked Questions, FDA.
4. Common Vulnerability Scoring System (CVSS), FIRST.Org, Inc..
5. Rubric for Applying CVSS to Medical Devices, MITRE.
6. ANSI/AAMI SW96:2023, Standard for medical device security: Security risk management for device manufacturers, AAMI.
7. ISO 14971:2019, Medical devices: Application of risk management to medical devices, ISO.
8. Medical Technology and Health IT Joint Security Plan (JSP), Health Sector Coordinating Council.
9. IEC 62304:2006 (with Amd 1:2015), Medical device software: Software life cycle processes, IEC.