IMDRF N70: principles and practices for legacy medical device cybersecurity

N70 is a direct follow-on to IMDRF's N60 guidance, "Principles and Practices for Medical Device Cybersecurity," which introduced the Total Product Life Cycle (TPLC) framing and first raised the legacy-device concept without fully operationalising it. Per IMDRF's own published development timeline, N70 and its companion SBOM document N73 both went through public consultation in 2022 and were finalised together in April 2023 — N70 on 11 April and N73 two days later — reflecting that legacy-device risk assessment and software transparency are treated as two parts of the same problem.

IMDRF's definition is narrower and more specific than everyday usage of "legacy equipment." A legacy device, for N70's purposes, is one that cannot be reasonably protected against current and future cybersecurity threats. This is a statement about whether the device can be secured going forward, not a statement about its age or whether the manufacturer still sells it:

• A 10-year-old device that still receives timely security patches and runs on an architecture that supports modern authentication and encryption is not "legacy" under this definition, even though it is old.
• A device still within its advertised support window could in principle meet the definition if its underlying platform — an unsupported operating system version, for example — cannot be reasonably brought up to current security expectations without a redesign.

This framing is deliberately about risk management, not end-of-life paperwork: it tells a manufacturer or a hospital that the question to ask is "can this be reasonably protected," not just "is it still sold."

Per IMDRF's TPLC structure, N70's manufacturer-facing recommendations run across the device life cycle rather than treating legacy status as a problem only at end of life:

• Plan for eventual legacy status during design, not after a device is already unsupportable — architecture choices made at the premarket stage determine how long a device can realistically stay "not legacy."
• Maintain a current software inventory (the SBOM concept N73 details) so that when a component-level vulnerability surfaces, the manufacturer can tell quickly which fielded devices are affected.
• Communicate transition plans clearly to healthcare providers and regulators as a device approaches legacy status, rather than leaving users to discover the fact when a report goes unanswered.
• Coordinate disclosure and compensating controls for devices already past the point of a code-level fix, since a legacy device by definition cannot simply be patched back into a secure state.

The healthcare-provider side of N70 assumes the hospital or clinic did not design the device and cannot fix its underlying architecture, so its recommendations focus on risk management around a legacy device rather than remediation of it:

• Inventory which fielded devices are in legacy status, which depends on the manufacturer's own transparency about which products meet the definition.
• Apply compensating controls — network segmentation, access restriction, monitoring — around devices that cannot themselves be secured further.
• Factor legacy status into procurement and replacement planning, treating a device's realistic security lifespan as a purchasing criterion, not only its clinical function or purchase price.
• Coordinate with the manufacturer on any available mitigations rather than assuming a lack of a patch means no action is possible.

FDA's postmarket cybersecurity guidance addresses legacy devices directly, and secondary analysis of FDA's guidance footnotes describes FDA as sourcing its own legacy-device definition from IMDRF's work — FDA and Health Canada co-chaired the IMDRF working group that produced N60 and N70. That said, FDA continues to publish its own separate premarket and postmarket guidance documents under Section 524B rather than incorporating N70 by reference, so a US submission should still be checked against FDA's own current guidance text, with IMDRF's N70 as the shared conceptual background rather than a substitute citation.