How does TIR97 relate to FDA's Section 524B requirements?

FDA's 2023 Cybersecurity in Medical Devices guidance recognizes AAMI TIR97 as the consensus standard addressing the post-market vulnerability monitoring plan required under Section 524B(b)(2)(A), meaning a manufacturer that structures its post-market security SOPs around TIR97 has a recognized pathway for demonstrating that the statutory 'plan to monitor, identify, and address' post-market vulnerabilities requirement is met.

What kinds of artifacts does a TIR97-aligned post-market security program need to produce?

A TIR97-aligned program should be able to show a defined vulnerability intake and triage workflow, severity classification that links exploitability to patient-safety impact, coordinated vulnerability disclosure records, VEX statements documenting exploitability status of disclosed vulnerabilities, and evidence of customer notification and patch deployment, since these are the concrete artifacts that demonstrate the monitoring plan is operating in practice rather than existing only on paper.

Is TIR97 only relevant to newly cleared devices, or does it apply to legacy products too?

TIR97 applies to the entire installed base a manufacturer supports, including legacy devices that predate Section 524B's premarket cybersecurity requirements, because the post-market monitoring and vulnerability response obligations apply based on current marketing status rather than the device's original clearance date.

All terms

CybersecurityConnected & Cyber-Physical Devices Quality SystemTIR97

AAMI TIR97

AAMI Technical Information Report on post-market security risk management for medical device manufacturers, the operational companion to TIR57.

Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed June 20, 2026

Definition

AAMI TIR97 is a Technical Information Report providing guidance on post-market security risk management activities for medical device manufacturers. Where AAMI TIR57 covers security risk management across the full lifecycle (and aligns with ISO 14971), TIR97 zooms in on the post-market phase: vulnerability monitoring, intake and triage, exploitability and patient-safety impact assessment, coordinated disclosure, patch development, customer notification, and the metrics for an effective post-market security program.

What the regulation says

FDA's 2023 Cybersecurity in Medical Devices guidance recognizes AAMI TIR57 and TIR97 as the consensus standards for security risk management, TIR97 specifically addressing the 'plan to monitor, identify, and address post-market vulnerabilities' required under Section 524B(b)(2)(A).

What this means in practice

TIR97 is the operational playbook for the post-market obligations introduced by FDA Section 524B and the FDA 2023 Cybersecurity in Medical Devices guidance. It defines roles, intake workflows, severity classification (linking exploitability and patient harm), and the artifacts (advisories, VEX statements, customer letters) that prove a vulnerability monitoring plan is real. Many manufacturers structure their post-market security SOPs as a TIR97 implementation.

Examples

A MedTech manufacturer used AAMI TIR97 to establish a clear process for monitoring newly disclosed vulnerabilities in third-party software components embedded in their medical devices after they were released to market.
Following AAMI TIR97 guidelines, a device manufacturer developed an internal procedure for rapidly assessing the exploitability and potential patient safety impact of a newly discovered cybersecurity flaw in one of their deployed imaging systems.
To comply with post-market cybersecurity expectations, a MedTech company structured its incident response plan around AAMI TIR97's recommendations for coordinated vulnerability disclosure and customer communication.

Common pitfalls

•Implementing TIR57 without TIR97, the lifecycle standard sets requirements that TIR97 makes operationally measurable.
•Skipping the patient-safety impact assessment step and defaulting to CVSS, TIR97 expects an explicit linkage between exploitability and harm.
•Treating customer notification as a marketing artifact rather than a TIR97-required communication with defined content and timing.

Frequently asked questions

AAMI TIR57 addresses security risk management across the full device lifecycle and aligns closely with the ISO 14971 risk management process, while TIR97 focuses specifically on the post-market phase, providing operational guidance on vulnerability monitoring, intake and triage, exploitability and patient-safety impact assessment, coordinated disclosure, patch development, and customer notification. Manufacturers generally need both: TIR57 establishes lifecycle requirements, and TIR97 makes the post-market portion of those requirements operationally measurable.

Grouped by theme

Editor's picks

· Hand-selected related concepts

Cybersecurity

AAMI TIR57

AAMI Technical Information Report providing MedTech-specific guidance on cybersecurity risk management.

Cybersecurity

Coordinated Vulnerability Disclosure(CVD)

A documented process for receiving, triaging, and responsibly disclosing security vulnerabilities reported by external researchers.

Cybersecurity

IEC 81001-5-1

International standard defining secure-product-lifecycle activities for health software, including medical devices.

Cybersecurity

Premarket Cybersecurity Submission

The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device.

More in Cybersecurity

· Same category

Cybersecurity

Section 524B of the FD&C Act(524B)

The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices.

Cybersecurity

Vulnerability Exploitability eXchange(VEX)

A machine-readable statement that explains whether a known vulnerability is actually exploitable in a specific product.

Cybersecurity

AAMI SW96

AAMI/ANSI standard establishing requirements for medical-device cybersecurity activities throughout the lifecycle.

Cybersecurity

Brainjacking

Unauthorized remote control of an implanted neurostimulator (e.g., DBS) to alter stimulation parameters and harm a patient.

Cited by

Where this term appears across MedTech Terms.

Ecosystems (2)

Latest in MedTech

Sources

3 sources

Every citation below opens the original document. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.

Tier 2Regulator guidance and consensus· 2Tier 4Trade press and expert commentary· 1

Link health: 3 verified· last checked 2026-06-20

AAMI·1FDA·1HSCC·1

Inline markers like [1] jump to the matching reference above.

My progress

All terms0 / 513

Cybersecurity0 / 61

Saved on this device, and to your account when signed in. View studied terms

Full glossary

Browse all terms A to Z, each with a short definition.

On this term

Category: Cybersecurity
Acronym: TIR97
Sources: 3
Updated: 6/20/2026

Compare with another term

Learn in 60 seconds

AAMI Technical Information Report on post-market security risk management for medical device manufacturers, the operational companion to TIR57.

·TIR97 is the operational playbook for the post-market obligations introduced by FDA Section 524B and the FDA 2023 Cybersecurity in Medical Devices guidance.
·Many manufacturers structure their post-market security SOPs as a TIR97 implementation.

Remember this

Watch out: Implementing TIR57 without TIR97, the lifecycle standard sets requirements that TIR97 makes operationally measurable.

Related terms

You may also need

Auto-suggested from Cybersecurity and shared keywords.

All Cybersecurity terms

From the Blue Goat network

Related resources and services on this topic.