MedTech Terms
    The authoritative reference
    All terms
    CybersecurityConnected & Cyber-Physical DevicesQuality SystemSPDF

    Secure Product Development Framework

    A documented, risk-based set of processes that build cybersecurity into a medical device across its full lifecycle.

    Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed May 5, 2026

    Definition

    A Secure Product Development Framework (SPDF) is a documented set of processes that integrates security activities - threat modeling, secure design, secure coding, security testing, vulnerability management, and end-of-support planning - into every phase of the medical device product lifecycle. FDA's September 2023 cybersecurity guidance positions an SPDF as the recommended foundation for meeting section 524B, and explicitly calls out IEC 81001-5-1 ("Health software - Part 5-1: Security - Activities in the product life cycle") as an acceptable industry framework.
    What the regulation says
    FDA does not require any single named framework, but does expect the sponsor to identify, document, and follow one. IEC 81001-5-1 is the most cited because it maps directly onto the IEC 62304 software lifecycle and ISO 14971 risk management processes already familiar to MedTech QMSs. NIST's Secure Software Development Framework (SSDF, SP 800-218) and the SAFECode practices are also acceptable. The submission should include the SPDF policy/procedure, and the artifacts in the submission should clearly trace back to the SPDF activities.

    What this means in practice

    An SPDF is the antidote to the 'cybersecurity is QA's job at the end' antipattern. Mature MedTech teams encode the SPDF as procedures inside the existing QMS - reusing design controls, design review checkpoints, and CAPA - rather than running cybersecurity as a parallel program. This makes audit responses and CAPA traceability dramatically easier and avoids duplicate documentation.
    Common pitfalls
    • •Adopting an SPDF on paper but not running its activities (threat models, security reviews) at the design checkpoints.
    • •Treating IEC 81001-5-1 conformance as optional after FDA's explicit endorsement in the 2023 guidance.
    • •Keeping security artifacts outside the QMS, leading to versioning and traceability problems at audit.

    Frequently asked questions

    Not legally required, but FDA's 2023 guidance recognizes it as an acceptable SPDF and most MedTech teams pursuing FDA submissions are aligning to it. EU Notified Bodies are increasingly looking for it as evidence of MDR Annex I §17.2 conformity.

    Cross-references

    Used by

    Related terms

    Shared paths + category
    Cybersecurity
    Section 524B of the FD&C Act(524B)

    The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices.

    FDA Cybersecurity 101 · adjacentSoftware Team Onboarding · adjacent
    Cybersecurity
    Threat Modeling

    A structured analysis that identifies how an attacker could compromise a medical device and what controls mitigate each threat.

    FDA Cybersecurity 101 · adjacentSoftware Team Onboarding · adjacent
    Cybersecurity
    Premarket Cybersecurity Submission

    The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device.

    FDA Cybersecurity 101 · adjacent
    Standards
    IEC 62304

    Lifecycle requirements for medical device software.

    Software Team Onboarding
    Cybersecurity
    IEC 81001-5-1

    International standard defining secure-product-lifecycle activities for health software, including medical devices.

    Same category
    Cybersecurity
    NIST Cybersecurity Framework(NIST CSF)

    A risk-based framework of cybersecurity functions and outcomes published by NIST and widely used to organize MedTech security programs.

    Same category

    Latest in MedTech

    Primary references

    3 sources
    Link health: 3 verified· last checked 2026-06-20
    FDA·1ISO/IEC·1NIST·1
    1. 1
      FDA Cybersecurity in Medical Devices Guidance (Sept 2023)
      Verified
      FDAfda.gov
    2. 2
      IEC 81001-5-1:2021
      Verified
      ISO/IECiso.org
    3. 3
      NIST SP 800-218 Secure Software Development Framework (SSDF)
      Verified
      NISTcsrc.nist.gov

    Inline markers like [1] jump to the matching reference above.