--- title: "SPDF, Secure Product Development Framework | MedTech Terms" description: "A documented, risk-based set of processes that build cybersecurity into a medical device across its full lifecycle." lang: en json-ld: | { "@context": "https://schema.org", "@graph": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/spdf#term", "name": "Secure Product Development Framework", "alternateName": "SPDF", "description": "A Secure Product Development Framework (SPDF) is a documented set of processes that integrates security activities - threat modeling, secure design, secure coding, security testing, vulnerability management, and end-of-support planning - into every phase of the medical device product lifecycle. FDA's September 2023 cybersecurity guidance positions an SPDF as the recommended foundation for meeting section 524B, and explicitly calls out IEC 81001-5-1 (\"Health software - Part 5-1: Security - Activities in the product life cycle\") as an acceptable industry framework.", "url": "https://medtechterms.com/terms/spdf", "termCode": "spdf", "inDefinedTermSet": { "@type": "DefinedTermSet", "name": "MedTech Terms", "url": "https://medtechterms.com/terms" } }, { "@type": "Article", "@id": "https://medtechterms.com/terms/spdf#article", "headline": "SPDF, Secure Product Development Framework", "description": "A documented, risk-based set of processes that build cybersecurity into a medical device across its full lifecycle.", "url": "https://medtechterms.com/terms/spdf", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://medtechterms.com/terms/spdf" }, "about": { "@id": "https://medtechterms.com/terms/spdf#term" }, "articleSection": "Cybersecurity", "inLanguage": "en", "keywords": "Secure Product Development Framework, SPDF, Cybersecurity, medical device, MedTech", "author": { "@type": "Person", "name": "Christian Espinosa", "jobTitle": "Founder, Blue Goat Cyber", "url": "https://bluegoatcyber.com" }, "publisher": { "@type": "Organization", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "isPartOf": { "@type": "WebSite", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "datePublished": "2026-05-05", "dateModified": "2026-05-05", "citation": [ { "@type": "CreativeWork", "name": "FDA Cybersecurity in Medical Devices Guidance (Sept 2023)", "url": "https://www.fda.gov/regulatory-information/search-fda-guidance-documents/cybersecurity-medical-devices-quality-system-considerations-and-content-premarket-submissions", "publisher": { "@type": "Organization", "name": "FDA" } }, { "@type": "CreativeWork", "name": "IEC 81001-5-1:2021", "url": "https://www.iso.org/standard/76097.html", "publisher": { "@type": "Organization", "name": "ISO/IEC" } }, { "@type": "CreativeWork", "name": "NIST SP 800-218 Secure Software Development Framework (SSDF)", "url": "https://csrc.nist.gov/publications/detail/sp/800-218/final", "publisher": { "@type": "Organization", "name": "NIST" } } ], "mentions": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/section-524b#term", "name": "Section 524B of the FD&C Act", "alternateName": "524B", "url": "https://medtechterms.com/terms/section-524b" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/premarket-cybersecurity#term", "name": "Premarket Cybersecurity Submission", "url": "https://medtechterms.com/terms/premarket-cybersecurity" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/iec-81001-5-1#term", "name": "IEC 81001-5-1", "url": "https://medtechterms.com/terms/iec-81001-5-1" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/iec-62304#term", "name": "IEC 62304", "url": "https://medtechterms.com/terms/iec-62304" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/nist-csf#term", "name": "NIST Cybersecurity Framework", "alternateName": "NIST CSF", "url": "https://medtechterms.com/terms/nist-csf" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/threat-modeling#term", "name": "Threat Modeling", "url": "https://medtechterms.com/terms/threat-modeling" } ] }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://medtechterms.com/" }, { "@type": "ListItem", "position": 2, "name": "Terms", "item": "https://medtechterms.com/terms" }, { "@type": "ListItem", "position": 3, "name": "Cybersecurity", "item": "https://medtechterms.com/terms?cat=Cybersecurity" }, { "@type": "ListItem", "position": 4, "name": "Secure Product Development Framework", "item": "https://medtechterms.com/terms/spdf" } ] }, { "@type": "FAQPage", "@id": "https://medtechterms.com/terms/spdf#faq", "mainEntity": [ { "@type": "Question", "name": "Is IEC 81001-5-1 required?", "acceptedAnswer": { "@type": "Answer", "text": "Not legally required, but FDA's 2023 guidance recognizes it as an acceptable SPDF and most MedTech teams pursuing FDA submissions are aligning to it. EU Notified Bodies are increasingly looking for it as evidence of MDR Annex I §17.2 conformity." } }, { "@type": "Question", "name": "How does an SPDF relate to IEC 62304?", "acceptedAnswer": { "@type": "Answer", "text": "IEC 62304 covers the software safety lifecycle; the SPDF (e.g., IEC 81001-5-1) covers the security lifecycle. They run in parallel and share most checkpoints, so they're typically merged into one combined software development plan." } }, { "@type": "Question", "name": "Can we use NIST SSDF instead of IEC 81001-5-1?", "acceptedAnswer": { "@type": "Answer", "text": "Yes, NIST SP 800-218 (SSDF) is acceptable and is often a better fit for teams already using NIST CSF or NIST 800-53. The choice matters less than rigorous, documented execution." } } ] } ] } --- [ MedTech Terms The authoritative reference ](/) Browse Learn [Latest](/latest) About 1. [Home](/) 2. / 3. [Terms](/terms) 4. / 5. [Cybersecurity](/terms?cat=Cybersecurity) 6. / 7. Secure Product Development Framework [All terms](/terms) Cybersecurity [Connected & Cyber-Physical Devices](/ecosystems/connected-devices)[Quality System](/ecosystems/quality-system)SPDF # Secure Product Development Framework A documented, risk-based set of processes that build cybersecurity into a medical device across its full lifecycle. Reviewed by [Christian Espinosa, Founder, Blue Goat Cyber](/authors/christian-espinosa) Last reviewed May 5, 2026 ## Definition A Secure Product Development Framework (SPDF) is a documented set of processes that integrates security activities - [threat modeling](/terms/threat-modeling), secure design, secure coding, security testing, vulnerability management, and end-of-support planning - into every phase of the medical device product lifecycle. FDA's September 2023 cybersecurity guidance positions an SPDF as the recommended foundation for meeting section [524B](/terms/section-524b), and explicitly calls out [IEC 81001-5-1](/terms/iec-81001-5-1) ("Health software - Part 5-1: Security - Activities in the product life cycle") as an acceptable industry framework. What the regulation says FDA does not require any single named framework, but does expect the sponsor to identify, document, and follow one. [IEC 81001-5-1](/terms/iec-81001-5-1) is the most cited because it maps directly onto the [IEC 62304](/terms/iec-62304) software lifecycle and [ISO 14971](/terms/iso-14971) risk management processes already familiar to MedTech QMSs. NIST's [Secure Software Development Framework](/terms/ssdf) (SSDF, SP 800-218) and the SAFECode practices are also acceptable. The submission should include the SPDF policy/procedure, and the artifacts in the submission should clearly trace back to the SPDF activities. ## What this means in practice An SPDF is the antidote to the 'cybersecurity is QA's job at the end' antipattern. Mature MedTech teams encode the SPDF as procedures inside the existing QMS - reusing [design controls](/terms/design-controls), design review checkpoints, and [CAPA](/terms/capa) - rather than running cybersecurity as a parallel program. This makes audit responses and CAPA traceability dramatically easier and avoids duplicate documentation. Common pitfalls - • Adopting an SPDF on paper but not running its activities (threat models, security reviews) at the design checkpoints. - • Treating IEC 81001-5-1 conformance as optional after FDA's explicit endorsement in the 2023 guidance. - • Keeping security artifacts outside the QMS, leading to versioning and traceability problems at audit. ## Frequently asked questions Is IEC 81001-5-1 required? Not legally required, but FDA's 2023 guidance recognizes it as an acceptable SPDF and most MedTech teams pursuing FDA submissions are aligning to it. EU Notified Bodies are increasingly looking for it as evidence of [MDR](/terms/mdr-reporting) Annex I §17.2 conformity. How does an SPDF relate to IEC 62304? Can we use NIST SSDF instead of IEC 81001-5-1? ## Cross-references ### Used by Things that build on this term. - [ Premarket Cybersecurity Submission ](/terms/premarket-cybersecurity) ## Related terms Grouped by theme ### Editor's picks · Hand-selected related concepts [ Cybersecurity Section 524B of the FD&C Act(524B) The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices. ](/terms/section-524b)[ Cybersecurity Threat Modeling A structured analysis that identifies how an attacker could compromise a medical device and what controls mitigate each threat. ](/terms/threat-modeling)[ Cybersecurity Premarket Cybersecurity Submission The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device. ](/terms/premarket-cybersecurity)[ Standards IEC 62304 Lifecycle requirements for medical device software. ](/terms/iec-62304) ### FDA Cybersecurity 101 · From this learning path [ Cybersecurity Software Bill of Materials(SBOM) A machine-readable inventory of all software components, including open-source and third-party libraries, used to build a medical device. Adjacent lesson ](/terms/sbom?from=fda-cybersecurity-101)[ Cybersecurity Common Vulnerabilities and Exposures(CVE) A globally unique identifier for a publicly disclosed cybersecurity vulnerability. ](/terms/cve?from=fda-cybersecurity-101)[ Cybersecurity Common Vulnerability Scoring System(CVSS) An industry-standard 0–10 score that quantifies the severity of a software vulnerability. ](/terms/cvss?from=fda-cybersecurity-101)[ Cybersecurity CycloneDX A lightweight, OWASP-maintained SBOM format designed for application security and supply-chain use cases. ](/terms/cyclonedx?from=fda-cybersecurity-101) ### Software Team Onboarding · From this learning path [ Software & AI Clinical Decision Support(CDS) Software providing healthcare professionals with knowledge and patient-specific information. ](/terms/cds?from=software-team-onboarding)[ Software & AI Predetermined Change Control Plan(PCCP) FDA mechanism to pre-authorize specific modifications to AI/ML-enabled devices. ](/terms/ai-ml-pccp?from=software-team-onboarding)[ Software & AI Software as a Medical Device(SaMD) Software intended for medical purposes that performs without being part of a hardware device. ](/terms/samd?from=software-team-onboarding)[ Software & AI Software in a Medical Device(SiMD) Software embedded in or required to operate a hardware medical device. ](/terms/simd?from=software-team-onboarding) Cited by Where this term appears across MedTech Terms. Learning paths (2) - [FDA Cybersecurity 101](/paths/fda-cybersecurity-101)Lesson 3 of 11 - [Software Team Onboarding](/paths/software-team-onboarding)Lesson 9 of 12 Ecosystems (2) - [Connected & Cyber-Physical Devices](/ecosystems/connected-devices) - [Quality System](/ecosystems/quality-system) ## Primary references 3 sources Link health: 3 verified · last checked 2026-06-20 FDA· 1 ISO/IEC· 1 NIST· 1 1. [1 FDA Cybersecurity in Medical Devices Guidance (Sept 2023) Verified FDA · fda.gov ](https://www.fda.gov/regulatory-information/search-fda-guidance-documents/cybersecurity-medical-devices-quality-system-considerations-and-content-premarket-submissions) 2. [2 IEC 81001-5-1:2021 Verified ISO/IEC · iso.org ](https://www.iso.org/standard/76097.html) 3. [3 NIST SP 800-218 Secure Software Development Framework (SSDF) Verified NIST · csrc.nist.gov ](https://csrc.nist.gov/publications/detail/sp/800-218/final) Inline markers like \[1\] jump to the matching reference above. Sponsor note ### Working on medical device cybersecurity? Blue Goat Cyber specializes in MedTech cybersecurity - threat modeling, SBOMs, penetration testing, and FDA premarket submissions. [Book a 30-minute discovery session](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session) - No obligation - Expert-led from minute one - NDA available on request MedTech Terms is a community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com). Definitions are independent of any vendor. On this term Category Cybersecurity Acronym SPDF Sources 3 Updated 5/5/2026 [Compare with another term](/compare?a=spdf) Learn in 60 seconds Card Lesson Quiz A documented, risk-based set of processes that build cybersecurity into a medical device across its full lifecycle. - · An SPDF is the antidote to the 'cybersecurity is QA's job at the end' antipattern. - · Mature MedTech teams encode the SPDF as procedures inside the existing QMS - reusing design controls, design review checkpoints, and CAPA - rather than running cybersecurity as a parallel program. - · This makes audit responses and CAPA traceability dramatically easier and avoids duplicate documentation. Remember this Watch out: Adopting an SPDF on paper but not running its activities (threat models, security reviews) at the design checkpoints. Related terms - [Section 524B of the FD&C Act(524B) ](/terms/section-524b) - [Premarket Cybersecurity Submission ](/terms/premarket-cybersecurity) - [IEC 81001-5-1 ](/terms/iec-81001-5-1) - [IEC 62304 ](/terms/iec-62304) - [NIST Cybersecurity Framework(NIST CSF) ](/terms/nist-csf) - [Threat Modeling ](/terms/threat-modeling) You may also need Auto-suggested from Cybersecurity and shared keywords. - [AAMI TIR97(TIR97) ](/terms/aami-tir97) - [HSCC Joint Security Plan(HSCC JSP) ](/terms/hscc-jsp) - [AAMI SW96 ](/terms/aami-sw96) - [Health Industry Cybersecurity Practices(HICP) ](/terms/hicp) - [MITRE ATT&CK(ATT&CK) ](/terms/mitre-attack) - [NIST IR 8473, Cybersecurity Framework Profile for HPH(NIST IR 8473) ](/terms/nist-cswp-35) [All Cybersecurity terms](/terms?cat=Cybersecurity) From the Blue Goat network Related resources and services on this topic. - [ MedTech Cybersecurity Standards Authoritative reference for the standards and guidances behind medical device cybersecurity. ](https://medtechcyberstandards.com) - [ MedTech Cyber Tips Practical, organized tips for medical device cybersecurity teams. ](https://medtechcybertips.com) - [ MedTech Cybersecurity Crosswalk International crosswalk of medical device cybersecurity requirements across regulators. ](https://mdccrosswalk.com) - [ Code Blue Real medical device cybersecurity incidents and their lessons. ](https://codebluechart.com) MedTech Terms An authoritative, plain-language reference for the regulatory, quality, cybersecurity, and software terms that shape modern medical devices. Browse - [All terms](/terms) - [A–Z index](/a-z) - [Categories](/categories) - [Ecosystems](/ecosystems) - [Learning paths](/paths) - [Compare terms](/compare) - [Quiz](/quiz) Resources - [FDA Medical Devices](https://www.fda.gov/medical-devices) - [EU MDR](https://eur-lex.europa.eu/eli/reg/2017/745/oj) - [IMDRF](https://www.imdrf.org/) - [Methodology](/methodology) - [Changelog](/changelog) - [Editor: Christian Espinosa](/authors/christian-espinosa) - [About this site](/about) © 2026 MedTech Terms. Reference content for educational purposes - not regulatory advice. A community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com)