MedTech Terms
    The authoritative reference
    All terms

    Legacy Device Cybersecurity

    Cybersecurity considerations for medical devices that cannot be reasonably protected against current threats.

    Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed May 5, 2026

    Definition

    A legacy medical device is one that cannot be reasonably protected against current cybersecurity threats - typically because the underlying OS or platform is unsupported (e.g., Windows XP/7, embedded RTOS without update path), the device cannot accept patches, or the manufacturer has ended support. IMDRF/CYBER WG/N73 (2023) defines the term and frames a shared-responsibility model among manufacturers, healthcare delivery organizations (HDOs), and other stakeholders.
    What the regulation says
    FDA's 2023 guidance and IMDRF N73 both expect manufacturers to publish end-of-support timelines and to communicate clearly to operators when a device transitions to legacy status. HDOs are expected to apply compensating controls (network segmentation, monitoring) for legacy devices that remain in clinical use.

    What this means in practice

    Legacy devices are ubiquitous in hospitals - imaging systems, infusion pumps, lab analyzers - and are repeatedly implicated in ransomware incidents. The right response is a documented end-of-life plan, transparent communication to operators, and a path to a supported replacement, not silent obsolescence.
    Common pitfalls
    • •Letting devices age into legacy status without notifying operators or providing compensating-control guidance.
    • •Assuming HDO network segmentation alone substitutes for manufacturer responsibility.
    • •Continuing to sell new units of a device that can no longer be patched.

    Frequently asked questions

    Per IMDRF N73, when it can no longer be reasonably protected against current threats - typically tied to the end of OS/platform support. The manufacturer should declare and communicate the date.

    Cross-references

    See also

    Closely related context worth reading.

    Primary references

    3 sources
    Link health: 2 verified 1 bot-blocked· last checked 2026-05-09
    IMDRF·1FDA·1HSCC·1
    1. 1
      IMDRF/CYBER WG/N73 (2023)
      Verified
      IMDRFimdrf.org
    2. 2
      FDA Cybersecurity Guidance (Sept 2023)
      Bot-blocked
      FDAfda.gov
    3. 3
      HSCC - Health Sector Coordinating Council
      Verified
      HSCChealthsectorcouncil.org

    Inline markers like [1] jump to the matching reference above.