--- title: "Code Signing, Definition | MedTech Terms" description: "Cryptographic signing of executable software and firmware so that only authentic, unmodified code from a trusted publisher will run." lang: en json-ld: | { "@context": "https://schema.org", "@graph": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/code-signing#term", "name": "Code Signing", "description": "Code signing is the practice of digitally signing executable files, firmware images, software packages, and OTA updates with a private key whose corresponding public key (in a certificate from a trusted certificate authority) is embedded in or trusted by the device. At install or boot, the device verifies the signature; if it doesn't validate against an expected publisher and the artifact hasn't been modified, the code is rejected. Code signing is the foundational control behind secure boot, OTA update verification, and anti-tampering on connected medical devices.", "url": "https://medtechterms.com/terms/code-signing", "termCode": "code-signing", "inDefinedTermSet": { "@type": "DefinedTermSet", "name": "MedTech Terms", "url": "https://medtechterms.com/terms" } }, { "@type": "Article", "@id": "https://medtechterms.com/terms/code-signing#article", "headline": "Code Signing", "description": "Cryptographic signing of executable software and firmware so that only authentic, unmodified code from a trusted publisher will run.", "url": "https://medtechterms.com/terms/code-signing", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://medtechterms.com/terms/code-signing" }, "about": { "@id": "https://medtechterms.com/terms/code-signing#term" }, "articleSection": "Cybersecurity", "inLanguage": "en", "keywords": "Code Signing, Cybersecurity, medical device, MedTech", "author": { "@type": "Person", "name": "Christian Espinosa", "jobTitle": "Founder, Blue Goat Cyber", "url": "https://bluegoatcyber.com" }, "publisher": { "@type": "Organization", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "isPartOf": { "@type": "WebSite", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "datePublished": "2026-06-20", "dateModified": "2026-06-20", "citation": [ { "@type": "CreativeWork", "name": "FDA Cybersecurity in Medical Devices guidance (2023)", "url": "https://www.fda.gov/regulatory-information/search-fda-guidance-documents/cybersecurity-medical-devices-quality-system-considerations-and-content-premarket-submissions", "publisher": { "@type": "Organization", "name": "FDA" } }, { "@type": "CreativeWork", "name": "NIST SP 800-57: Key Management", "url": "https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final", "publisher": { "@type": "Organization", "name": "NIST" } }, { "@type": "CreativeWork", "name": "MDCG Cybersecurity Guidance", "url": "https://health.ec.europa.eu/medical-devices-sector/new-regulations/guidance-mdcg-endorsed-documents-and-other-guidance_en", "publisher": { "@type": "Organization", "name": "MDCG" } } ], "mentions": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/secure-boot#term", "name": "Secure Boot", "url": "https://medtechterms.com/terms/secure-boot" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/hardware-root-of-trust#term", "name": "Hardware Root of Trust", "alternateName": "HRoT", "url": "https://medtechterms.com/terms/hardware-root-of-trust" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/ota-updates#term", "name": "Over-the-Air Updates", "alternateName": "OTA", "url": "https://medtechterms.com/terms/ota-updates" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/patchability#term", "name": "Patchability", "url": "https://medtechterms.com/terms/patchability" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/iec-81001-5-1#term", "name": "IEC 81001-5-1", "url": "https://medtechterms.com/terms/iec-81001-5-1" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/aami-sw96#term", "name": "AAMI SW96", "url": "https://medtechterms.com/terms/aami-sw96" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/premarket-cybersecurity#term", "name": "Premarket Cybersecurity Submission", "url": "https://medtechterms.com/terms/premarket-cybersecurity" } ] }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://medtechterms.com/" }, { "@type": "ListItem", "position": 2, "name": "Terms", "item": "https://medtechterms.com/terms" }, { "@type": "ListItem", "position": 3, "name": "Cybersecurity", "item": "https://medtechterms.com/terms?cat=Cybersecurity" }, { "@type": "ListItem", "position": 4, "name": "Code Signing", "item": "https://medtechterms.com/terms/code-signing" } ] } ] } --- [ MedTech Terms The authoritative reference ](/) Browse Learn [Latest](/latest) About 1. [Home](/) 2. / 3. [Terms](/terms) 4. / 5. [Cybersecurity](/terms?cat=Cybersecurity) 6. / 7. Code Signing [All terms](/terms) Cybersecurity [Connected & Cyber-Physical Devices](/ecosystems/connected-devices)[Software Lifecycle](/ecosystems/software-lifecycle) # Code Signing Cryptographic signing of executable software and firmware so that only authentic, unmodified code from a trusted publisher will run. Reviewed by [Christian Espinosa, Founder, Blue Goat Cyber](/authors/christian-espinosa) Last reviewed June 20, 2026 ## Definition Code signing is the practice of digitally signing executable files, firmware images, software packages, and [OTA](/terms/ota-updates) updates with a private key whose corresponding public key (in a certificate from a trusted certificate authority) is embedded in or trusted by the device. At install or boot, the device verifies the signature; if it doesn't validate against an expected publisher and the artifact hasn't been modified, the code is rejected. Code signing is the foundational control behind [secure boot](/terms/secure-boot), OTA update verification, and anti-tampering on connected medical devices. What the regulation says FDA's 2023 Cybersecurity in Medical Devices guidance lists 'Authenticity and Integrity of Updates' as a core security capability. [IEC 81001-5-1](/terms/iec-81001-5-1) §5.7.2 and §9.6 expect signed updates and secure key management. [AAMI SW96](/terms/aami-sw96) requires code signing for distributed software components. ## What this means in practice FDA premarket cybersecurity submissions are expected to describe how the device verifies the authenticity and integrity of firmware and software updates. Code signing, paired with a [hardware root of trust](/terms/hardware-root-of-trust) to protect verification keys, is the standard answer. Key management is where most code-signing programs fail: signing keys stored in source control, in unprotected CI build agents, or shared across product lines have caused some of the most severe medical device cybersecurity advisories. Common pitfalls - • Storing signing keys in CI/CD environment variables or unencrypted on build servers, keys belong in an HSM or hardware-backed key store. - • Using the same signing key across product lines and over many years, key rotation and per-product or per-release keys limit blast radius. - • Verifying signatures only at install time, not at boot, pair code signing with secure boot to defend against post-install tampering. ## Related terms Grouped by theme ### Editor's picks · Hand-selected related concepts [ Cybersecurity AAMI SW96 AAMI/ANSI standard establishing requirements for medical-device cybersecurity activities throughout the lifecycle. ](/terms/aami-sw96)[ Cybersecurity Hardware Root of Trust(HRoT) A tamper-resistant hardware element (TPM, secure element, or fused boot ROM) that provides the foundational, unforgeable trust anchor for secure boot, attestation, and key storage. ](/terms/hardware-root-of-trust)[ Cybersecurity IEC 81001-5-1 International standard defining secure-product-lifecycle activities for health software, including medical devices. ](/terms/iec-81001-5-1)[ Cybersecurity Over-the-Air Updates(OTA) Remote, network-delivered software or firmware updates to a fielded medical device. ](/terms/ota-updates) ### More in Cybersecurity · Same category [ Cybersecurity Patchability The designed-in ability to deploy security updates to a fielded medical device in a timely, controlled, and verifiable manner. ](/terms/patchability)[ Cybersecurity Premarket Cybersecurity Submission The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device. ](/terms/premarket-cybersecurity)[ Cybersecurity Secure Boot A chain-of-trust mechanism that ensures only cryptographically signed firmware and software can run on a device. ](/terms/secure-boot)[ Cybersecurity AAMI TIR57 AAMI Technical Information Report providing MedTech-specific guidance on cybersecurity risk management. ](/terms/aami-tir57) Cited by Where this term appears across MedTech Terms. Ecosystems (2) - [Connected & Cyber-Physical Devices](/ecosystems/connected-devices) - [Software Lifecycle](/ecosystems/software-lifecycle) ## Primary references 3 sources Link health: 3 verified · last checked 2026-06-20 FDA· 1 NIST· 1 MDCG· 1 1. [1 FDA Cybersecurity in Medical Devices guidance (2023) Verified FDA · fda.gov ](https://www.fda.gov/regulatory-information/search-fda-guidance-documents/cybersecurity-medical-devices-quality-system-considerations-and-content-premarket-submissions) 2. [2 NIST SP 800-57: Key Management Verified NIST · csrc.nist.gov ](https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final) 3. [3 MDCG Cybersecurity Guidance Verified MDCG · health.ec.europa.eu ](https://health.ec.europa.eu/medical-devices-sector/new-regulations/guidance-mdcg-endorsed-documents-and-other-guidance_en) Inline markers like \[1\] jump to the matching reference above. Sponsor note ### Working on medical device cybersecurity? Blue Goat Cyber specializes in MedTech cybersecurity - threat modeling, SBOMs, penetration testing, and FDA premarket submissions. [Book a 30-minute discovery session](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session) - No obligation - Expert-led from minute one - NDA available on request MedTech Terms is a community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com). Definitions are independent of any vendor. On this term Category Cybersecurity Sources 3 Updated 6/20/2026 [Compare with another term](/compare?a=code-signing) Learn in 60 seconds Card Lesson Quiz Cryptographic signing of executable software and firmware so that only authentic, unmodified code from a trusted publisher will run. - · FDA premarket cybersecurity submissions are expected to describe how the device verifies the authenticity and integrity of firmware and software updates. - · Code signing, paired with a hardware root of trust to protect verification keys, is the standard answer. - · At install or boot, the device verifies the signature; if it doesn't validate against an expected publisher and the artifact hasn't been modified, the code is rejected. Remember this Watch out: Storing signing keys in CI/CD environment variables or unencrypted on build servers, keys belong in an HSM or hardware-backed key store. Related terms - [Secure Boot ](/terms/secure-boot) - [Hardware Root of Trust(HRoT) ](/terms/hardware-root-of-trust) - [Over-the-Air Updates(OTA) ](/terms/ota-updates) - [Patchability ](/terms/patchability) - [IEC 81001-5-1 ](/terms/iec-81001-5-1) - [AAMI SW96 ](/terms/aami-sw96) - [Premarket Cybersecurity Submission ](/terms/premarket-cybersecurity) You may also need Auto-suggested from Cybersecurity and shared keywords. - [Hardcoded Credentials ](/terms/hardcoded-credentials) - [OWASP IoT and Embedded Application Security ](/terms/owasp-iot) - [ICS Medical Advisory(ICSMA) ](/terms/ics-medical-advisory) - [Legacy Device Cybersecurity ](/terms/legacy-device-cyber) - [SOC 2 ](/terms/soc-2) - [Software Bill of Materials(SBOM) ](/terms/sbom) [All Cybersecurity terms](/terms?cat=Cybersecurity) From the Blue Goat network Related resources and services on this topic. - [ MedTech Cybersecurity Standards Authoritative reference for the standards and guidances behind medical device cybersecurity. ](https://medtechcyberstandards.com) - [ MedTech Cyber Tips Practical, organized tips for medical device cybersecurity teams. ](https://medtechcybertips.com) - [ MedTech Cybersecurity Crosswalk International crosswalk of medical device cybersecurity requirements across regulators. ](https://mdccrosswalk.com) - [ Code Blue Real medical device cybersecurity incidents and their lessons. ](https://codebluechart.com) MedTech Terms An authoritative, plain-language reference for the regulatory, quality, cybersecurity, and software terms that shape modern medical devices. Browse - [All terms](/terms) - [A–Z index](/a-z) - [Categories](/categories) - [Ecosystems](/ecosystems) - [Learning paths](/paths) - [Compare terms](/compare) - [Quiz](/quiz) Resources - [FDA Medical Devices](https://www.fda.gov/medical-devices) - [EU MDR](https://eur-lex.europa.eu/eli/reg/2017/745/oj) - [IMDRF](https://www.imdrf.org/) - [Methodology](/methodology) - [Changelog](/changelog) - [Editor: Christian Espinosa](/authors/christian-espinosa) - [About this site](/about) © 2026 MedTech Terms. Reference content for educational purposes - not regulatory advice. A community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com)