MedTech Terms
    The authoritative reference
    All terms
    Market SegmentsStrategic LandscapeCRM

    Cardiac Rhythm Management

    Implantable and external devices that monitor and treat cardiac arrhythmias — pacemakers, ICDs, CRT devices, and insertable cardiac monitors.

    Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed May 9, 2026

    Definition

    Cardiac Rhythm Management (CRM) is the MedTech segment that develops devices for diagnosing and treating bradyarrhythmias, tachyarrhythmias, and heart failure conduction disorders. The category covers permanent pacemakers (single, dual, leadless), implantable cardioverter defibrillators (ICDs), cardiac resynchronization therapy (CRT-P, CRT-D), insertable cardiac monitors (ICMs), and the leads, programmers, and remote-monitoring infrastructure that surround them. CRM devices are almost exclusively Class III in the US (PMA pathway) because they support or sustain life, and almost all modern CRM systems include wireless telemetry that places them squarely under FDA's Section 524B cyber device authority.
    What the regulation says
    Most CRM devices follow PMA (21 CFR 814) and are governed by FDA-recognized consensus standards including ISO 14708-1/-2/-6 (active implantable medical devices) and IEC 60601-2-31. ICDs and pacemakers are subject to dedicated FDA guidance on premarket submissions and to mandatory MDR reporting under 21 CFR Part 803. Connected CRM systems are cyber devices under Section 524B of the FD&C Act and must include a SBOM, vulnerability monitoring plan, and coordinated disclosure process.

    What this means in practice

    CRM is one of the highest-revenue MedTech segments and a leading source of post-market cybersecurity advisories (Medtronic CareLink/Conexus, St. Jude Merlin@home). Market dynamics are shaped by leadless pacing, extravascular ICDs, conduction-system pacing, and remote-monitoring reimbursement (CPT 93294-93298).
    Common pitfalls
    • •Treating CRM telemetry links as a closed system — they are cyber-device interfaces under 524B.
    • •Underestimating the regulatory burden of lead changes, which often require a PMA supplement.
    • •Ignoring remote-monitoring reimbursement codes that materially shape product economics.

    Frequently asked questions

    They go through PMA like traditional pacemakers but are reviewed under their own product codes (e.g., NVZ for leadless single-chamber). FDA has issued device-specific guidance for them.

    Primary references

    3 sources
    Link health: 2 verified 1 bot-blocked· last checked 2026-05-09
    FDA·1ISO·1HRS·1
    1. 1
      FDA — Pacemakers
      Bot-blocked
      FDAfda.gov
    2. 2
      ISO 14708-2 Active implantable medical devices — Pacemakers
      Verified
      ISOiso.org
    3. 3
      Heart Rhythm Society Remote Monitoring Consensus
      Verified
      HRShrsonline.org

    Inline markers like [1] jump to the matching reference above.