Regulatory History and Framework

This chapter traces the evolution of medical device cybersecurity regulation from early FDA guidance through current legal requirements, providing the regulatory context needed for compliance.

Medical device cybersecurity went from an unregulated gray area to a legal mandate in about a decade, and this chapter explains how that happened and what it means for anyone bringing a device to market. It starts with the conditions that forced FDA's hand: connected devices multiplying in hospitals, researchers demonstrating real attacks on insulin pumps and pacemakers, and manufacturers themselves asking for clear expectations. From there it walks through each phase of FDA's response, beginning with the 2014 premarket guidance, then the 2016 postmarket guidance, then Section 524B of the FD&C Act, which made cybersecurity legally mandatory for "cyber devices," and finally the current premarket guidance with its Secure Product Development Framework.

The chapter then sorts out what's actually required by law versus what FDA "recommends" but expects in practice. That distinction trips up a lot of manufacturers, since guidance documents are technically nonbinding while missing documentation still triggers deficiency letters and clearance delays. There's also a tour of the standards that do the heavy lifting in real submissions: AAMI SW96 for security risk management, ISO 14971, IEC 62304, IEC 62443, ISO 81001-5-1, and the NIST and FIPS references FDA reviewers look for.

Later sections cover international requirements (IMDRF guidance, the EU MDR, and the approaches taken by Canada, Japan, and Australia), industry tools like the Joint Security Plan and MITRE's CVSS rubric for medical devices, and a practical sequence for building a regulatory strategy: classify your device, identify applicable requirements, run a gap analysis, and plan the work by risk. By the end you should be able to tell which requirements apply to your device, which documents belong in your submission, and where the rules are headed next.