Cybersecurity
Postmarket Cybersecurity Management
In one line
FDA's framework for ongoing vulnerability monitoring, risk assessment, and remediation of medical device cybersecurity issues after a device is on the market.
Definition
Postmarket cybersecurity management refers to the processes a manufacturer maintains after commercial release to identify, assess, and remediate cybersecurity vulnerabilities in fielded medical devices. FDA's 2016 guidance 'Postmarket Management of Cybersecurity in Medical Devices' distinguishes controlled risk, where the residual risk of patient harm after applying compensating controls is acceptable, from uncontrolled risk, where it is not. For uncontrolled risk, FDA expects manufacturers to notify users and remediate, typically as an urgent action, and to disclose vulnerabilities to an ISAO or coordinate with CISA. The guidance also describes when a cybersecurity software patch is considered a routine, quality-system update that does not require a new premarket submission or a Correction/Removal report under 21 CFR Part 806, versus when a change affects safety or effectiveness enough to trigger reporting or a new clearance.
Why it matters
Manufacturers implement postmarket cybersecurity management through a coordinated vulnerability disclosure program, a documented risk assessment methodology tied to CVSS or a similar scoring model, participation in an ISAO such as Health-ISAC, and a patch cadence that maps remediation timelines to risk level. FDA's 2023 premarket cybersecurity guidance and the FD&C Act Section 524B statutory requirements for cyber devices reinforce that postmarket capability, including a plan for coordinated vulnerability disclosure and postmarket monitoring, must be established before a device is authorized.
Common pitfalls
- •Treating every security patch as automatically exempt from 21 CFR 806 reporting; the exemption applies only to specific quality-system corrections meeting the guidance's routine-update criteria, not to fixes addressing an uncontrolled risk.
- •Assuming a fixed 30-day or 60-day deadline is a hard regulatory rule rather than a risk-based expectation described in guidance that manufacturers must tailor to the severity of the specific vulnerability.
- •Failing to maintain a software bill of materials, which slows down the ability to determine which fielded devices are affected when a new component vulnerability is disclosed.
Sources