Documentation Best Practices

Good security documentation does three things: it traces requirements through implementation to verification, it stays current as threats change, and it speaks to each audience that reads it. FDA reviewers, developers, customers, and auditors all rely on these documents, and each needs a different level of detail.

3.9.1 Traceability is Key

Connect everything:

• Requirements → Architecture → Implementation
• Threats → Risks → Controls
• Controls → Verification → Validation

3.9.2 Living Documents

Security documentation must evolve:

• Update threat models regularly
• Revise risk assessments
• Refine architecture views
• Track vulnerability landscape

3.9.3 Clear Communication

Remember your audiences:

• FDA Reviewers: Need comprehensive detail
• Development Teams: Need actionable guidance
• Customers: Need understandable information
• Auditors: Need traceable evidence

Sources

Primary documents for the topics in this section:

1. Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions, Section V.A.1 Threat Modeling, FDA, February 3, 2026.
2. FDA premarket cybersecurity guidance, Section V.A.2 Cybersecurity Risk Assessment, FDA, February 3, 2026.
3. FDA premarket cybersecurity guidance, Section V.B.2 Security Architecture Views and Appendix 2, FDA, February 3, 2026.