FDA postmarket management of cybersecurity in medical devices, explained

Everything in the guidance's reporting framework turns on one classification. The guidance defines:

• Controlled risk: present "when there is sufficiently low (acceptable) residual risk of patient harm due to a device's particular cybersecurity vulnerability."
• Uncontrolled risk: present "when there is unacceptable residual risk of patient harm due to inadequate compensating controls and risk mitigations."

Manufacturers reach that classification by assessing three factors the guidance names directly in Section VI: the likelihood of exploit, the impact of exploitation on the device's safety and essential performance, and the severity of patient harm if exploited — the guidance points to tools like the Common Vulnerability Scoring System (CVSS) v3.0 as one way to structure the exploitability half of that assessment.

A fix for a controlled-risk vulnerability generally counts as a "cybersecurity routine update or patch" — defined as a device enhancement, not a correction — so it is "generally not required to report... as corrections under 21 CFR part 806." Fixes for vulnerabilities with "a reasonable probability that use of, or exposure to, the product will cause serious adverse health consequences or death" are explicitly carved out of that routine-update definition regardless of classification.

For uncontrolled-risk vulnerabilities, the default is that manufacturers "must report these vulnerabilities to the FDA according to 21 CFR part 806" (absent reporting under Parts 803 or 1004). But the guidance then describes specific circumstances in which "the FDA does not intend to enforce reporting requirements under 21 CFR part 806" — all four of the following must be met:

1. No known serious adverse events or deaths are associated with the vulnerability.
2. Within 30 days of learning of the vulnerability (as soon as possible, no later than 30 days), the manufacturer communicates with customers and the user community, identifies interim compensating controls, and documents a remediation plan with its timeline rationale. The guidance specifies the customer communication must at minimum describe the vulnerability and its assessed impact, state that remediation is underway, describe any compensating controls, and commit to further communication about a fix.
3. Within 60 days of learning of the vulnerability (as soon as possible, no later than 60 days), the manufacturer fixes the vulnerability, validates the change, and distributes the deployable fix so residual risk reaches an acceptable level — with a note that compensating controls can serve as a long-term solution if they bring the risk down acceptably, and that the manufacturer should follow up with end-users beyond the initial 60-day window as needed.
4. The manufacturer actively participates as a member of an Information Sharing and Analysis Organization (ISAO) that shares medical device vulnerabilities and threats (the guidance's own example is NH-ISAC), and provides that ISAO with any customer communications made under point 2.

Miss any one of the four — most commonly, not being an active ISAO participant — and the guidance's own worked examples show the manufacturer reporting the same vulnerability under 21 CFR 806.10 instead. Class III devices with periodic (annual) reporting obligations under 21 CFR 814.84 must still summarize remediation activity in that report regardless of which reporting path applies. The guidance separately warns that an unremediated uncontrolled-risk device "may be considered to have a reasonable probability that use of, or exposure to, the product will cause serious adverse health consequences or death," exposing it to FD&C Act enforcement.

Because ISAO participation gates the 30/60-day reporting relief, Section IX defines it with four criteria FDA says it will consider:

1. The manufacturer is a member of an ISAO that shares vulnerabilities and threats affecting medical devices.
2. That ISAO has documented policies covering participant agreements, business processes, operating procedures and privacy protections.
3. The manufacturer shares vulnerability information with the ISAO, including the same customer communications made under the 30-day step above.
4. The manufacturer has documented processes for assessing and responding to vulnerability and threat intelligence received from the ISAO, traceable to its own device risk assessments and mitigations.

FDA recommends manufacturers maintain objective evidence against all four if they want to be credited as active participants — membership alone, without the information-sharing and traceability pieces, is not enough per the guidance's own framing.

The guidance's Appendix recommends building a postmarket cybersecurity program around the same five functions as NIST's Framework for Improving Critical Infrastructure Cybersecurity (Version 1.0): Identify, Protect, Detect, Respond and Recover. Under "Identify," it specifically calls out defining a device's safety and essential performance and the resulting severity of patient harm if compromised — the same triage inputs the controlled/uncontrolled assessment above depends on — plus using threat modeling to understand exploitability. Under "Protect/Detect," it calls for vulnerability characterization, analysis of threat sources, and incorporating threat-detection capability; under "Protect/Respond/Recover," risk mitigation of safety and essential performance.

This guidance predates two major developments readers should keep in mind. First, Section 524B of the FD&C Act — added by the Consolidated Appropriations Act, 2023 and effective 29 March 2023 — created a binding premarket statutory duty (SBOM, vulnerability-monitoring plan, secure-update process) for "cyber device" submissions that did not exist in 2016; see FDA premarket cybersecurity for medical devices for that duty. A cyber device's premarket vulnerability-monitoring plan is, in effect, the forward-looking commitment this 2016 postmarket guidance expects a manufacturer to actually execute after clearance. Second, some of the 2016 guidance's own cross-references — a 2014 premarket cybersecurity guidance it cites, for instance — have since been superseded by newer FDA premarket guidance documents. Despite both changes, FDA's own guidance index, as checked for this article, still lists the 2016 postmarket guidance as final and current, without a formal revision or withdrawal notice. Readers relying on its specific reporting-relief mechanics for a live compliance decision should confirm that status directly on FDA's guidance page before acting on it.