IMDRF Principles and Practices for Medical Device Cybersecurity
International harmonized guidance on medical-device cybersecurity from the IMDRF Cybersecurity Working Group.
Definition
The International Medical Device Regulators Forum (IMDRF) Cybersecurity Working Group has published a series of guidance documents - most notably IMDRF/CYBER WG/N60 (Principles and Practices for Medical Device Cybersecurity, 2020) and N73 (Principles and Practices for the Cybersecurity of Legacy Medical Devices, 2023) - that harmonize regulator expectations across jurisdictions including the FDA, Health Canada, MHRA, TGA, PMDA, and the EU.What this means in practice
MedTech teams pursuing global submissions use IMDRF principles as the common backbone, then layer on jurisdiction-specific requirements (524B for the US, MDCG 2019-16 for the EU). The legacy-device guidance (N73) is particularly valuable because it addresses devices designed before modern cybersecurity expectations existed.Examples
- A manufacturer developing a new implantable cardiac device ensures its cybersecurity design aligns with IMDRF principles, anticipating regulatory submissions in multiple countries.
- During a pre-market review, a regulatory body references IMDRF guidance to assess the robustness of a new diagnostic imaging system's cybersecurity features.
- A company managing a fleet of older infusion pumps uses the IMDRF legacy device guidance to develop a risk-based plan for addressing their cybersecurity vulnerabilities.
- •Treating IMDRF guidance as the ceiling rather than the floor - national regulators add specifics.
- •Ignoring N73's legacy-device guidance for products approaching end-of-support.
Frequently asked questions
Related terms
Grouped by themeEditor's picks
· Hand-selected related conceptsCybersecurity considerations for medical devices that cannot be reasonably protected against current threats.
The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device.
The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices.
International Medical Device Regulators Forum.
More in Cybersecurity
· Same categoryAAMI/ANSI standard establishing requirements for medical-device cybersecurity activities throughout the lifecycle.
AAMI Technical Information Report providing MedTech-specific guidance on cybersecurity risk management.
AAMI Technical Information Report on post-market security risk management for medical device manufacturers, the operational companion to TIR57.
Unauthorized remote control of an implanted neurostimulator (e.g., DBS) to alter stimulation parameters and harm a patient.
Where this term appears across MedTech Terms.
Latest in MedTech
Sources
3 sourcesSources support the definition or relevant regulatory context, not necessarily every claim on this page. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.
- 1IMDRF/CYBER WG/N60 (2020)Tier 2 VerifiedIMDRFimdrf.org
- 2IMDRF/CYBER WG/N73 (2023)Tier 2 VerifiedIMDRFimdrf.org
- 3FDA - Cybersecurity for Medical DevicesTier 2 VerifiedFDAfda.gov
Inline markers like [1] jump to the matching reference above.