MedTech Terms
    The authoritative reference
    All terms

    IMDRF Principles and Practices for Medical Device Cybersecurity

    International harmonized guidance on medical-device cybersecurity from the IMDRF Cybersecurity Working Group.

    Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed May 5, 2026

    Definition

    The International Medical Device Regulators Forum (IMDRF) Cybersecurity Working Group has published a series of guidance documents - most notably IMDRF/CYBER WG/N60 (Principles and Practices for Medical Device Cybersecurity, 2020) and N73 (Principles and Practices for the Cybersecurity of Legacy Medical Devices, 2023) - that harmonize regulator expectations across jurisdictions including the FDA, Health Canada, MHRA, TGA, PMDA, and the EU.
    What the regulation says
    IMDRF guidance is non-binding but heavily influences national regulators. FDA's 2023 cybersecurity guidance, Health Canada's Pre-market Requirements for Medical Device Cybersecurity, and the EU MDR Annex I §17.2 all align to IMDRF principles. Submitting a product that meets IMDRF principles materially eases multi-jurisdiction filings.

    What this means in practice

    MedTech teams pursuing global submissions use IMDRF principles as the common backbone, then layer on jurisdiction-specific requirements (524B for the US, MDCG 2019-16 for the EU). The legacy-device guidance (N73) is particularly valuable because it addresses devices designed before modern cybersecurity expectations existed.
    Common pitfalls
    • •Treating IMDRF guidance as the ceiling rather than the floor - national regulators add specifics.
    • •Ignoring N73's legacy-device guidance for products approaching end-of-support.

    Frequently asked questions

    No. IMDRF documents are harmonized recommendations. National regulators (FDA, Health Canada, MHRA, TGA, EU) adopt and adapt them through their own guidance and regulation.

    Primary references

    3 sources
    Link health: 2 verified 1 needs review· last checked 2026-05-09
    1. 1
      IMDRF Cybersecurity Guidance Documents
      Needs review
      IMDRFimdrf.org
    2. 2
      IMDRF/CYBER WG/N60 (2020)
      Verified
      IMDRFimdrf.org
    3. 3
      IMDRF/CYBER WG/N73 (2023)
      Verified
      IMDRFimdrf.org

    Inline markers like [1] jump to the matching reference above.