All terms
ICS Medical Advisory
CISA's official vulnerability advisories for medical devices, the public record of disclosed device cybersecurity issues, indexed as ICSMA-YY-DDD-NN.
Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed June 20, 2026
Definition
ICS Medical Advisories (ICSMAs) are official cybersecurity advisories published by CISA for medical devices, distinct from the more general ICS-Advisory (ICSA) series for industrial control systems. Each ICSMA describes affected products, vulnerability details (CVE IDs, CVSS scores), risk evaluation, mitigations, and the responsible manufacturer's coordinated disclosure timeline. ICSMAs are the public artifact of FDA-coordinated and H-ISAC-coordinated vulnerability disclosures and are referenced by hospital procurement, HDOs, and insurers when evaluating device cyber risk. What the regulation says
CISA publishes ICSMAs under its sector-specific advisory authority and coordinates closely with FDA's CDRH. FDA's 2023 Cybersecurity in Medical Devices guidance expects manufacturers to have processes for coordinated vulnerability disclosure with CISA. Section 524B's post-market expectations align with the ICSMA workflow.What this means in practice
Receiving an ICSMA is a defining moment for a medical device manufacturer's post-market cybersecurity program. The advisory triggers customer notifications, board-level reporting, often FDA Form 3500A scrutiny if patient harm is plausible, and a measurable test of the manufacturer's CVD and post-market plan. Manufacturers should map their disclosure SOPs explicitly to the ICSMA process and know who at CISA, FDA, and H-ISAC their coordination contacts are before an incident. Common pitfalls
- •Discovering ICSMA process for the first time during an incident, pre-establish CISA and FDA contacts and run a tabletop.
- •Treating ICSMAs as marketing damage to be minimized, incomplete or evasive advisories destroy trust with hospital customers far more than the underlying vulnerability.
- •Ignoring competitor ICSMAs, they are the best public signal of what credible attacks against your product class look like.
Primary references
3 sourcesLink health: 3 verified· last checked 2026-06-20
CISA·1MDCG·1HSCC·1
- 1CISA Coordinated Vulnerability Disclosure ProcessVerifiedCISAcisa.gov
- 2MDCG Cybersecurity GuidanceVerifiedMDCGhealth.ec.europa.eu
- 3HSCC - Health Sector Coordinating CouncilVerifiedHSCChealthsectorcouncil.org
Inline markers like [1] jump to the matching reference above.