Key takeaways
- UL 2900-2-1 is a Part 2 sector-specific standard, not a standalone one.
- UL's own 19 June 2018 announcement states plainly: "Device submissions to the FDA may now leverage testing and declarations of conformity to UL 2900-2-1 to streamline product review.
- Pair Part 2-1 with Part 1, not instead of it.
UL 2900-2-1, "Standard for Software Cybersecurity for Network-Connectable Products, Part 2-1: Particular Requirements for Network Connectable Components of Healthcare and Wellness Systems," is the healthcare-specific companion to UL 2900-1, published by UL Standards & Engagement (formerly Underwriters Laboratories). First published and ANSI-adopted in September 2017 as Edition 1, it received a revision published and ANSI-approved on 21 September 2023 (as ANSI/CAN/UL 2900-2-1), tied to changes carried over from the parent UL 2900-1 standard. Like UL 2900-1, it is a commercial standard — sold by UL and ANSI rather than published in full for free — so this guide draws on the publicly available scope statement, UL's own FDA-recognition announcement, and cross-checked secondary summaries rather than the purchased requirement text itself; treat specific sub-requirement wording as to be confirmed against a purchased copy before using it for a conformance claim.
What the scope statement covers
Per UL's own standards-store listing, UL 2900-2-1 "applies to testing of network connectable components in healthcare systems, including medical devices, accessories, medical device data systems, in vitro diagnostic devices, health information technology, wellness devices, and associated software." The scope extends to "all software components used for the secure operation of the device, wherever they may reside, including remote assets," and explicitly addresses products that combine regulated and unregulated components in a single integrated solution — relevant for vendors whose connected health product bundles a regulated medical-device function with an unregulated companion app or cloud service.
How it fits into the UL 2900 series
UL 2900-2-1 is a Part 2 sector-specific standard, not a standalone one. It builds on UL 2900-1's general, sector-agnostic requirements — risk management process, vulnerability/weakness/malware testing methods, and architectural security risk controls — and narrows them to healthcare and wellness obligations. Per secondary standards-tracking summaries, UL 2900-2-1 relies on test procedures and structure established in UL 2900-1, and UL's own guidance describes applying the two parts together as a "two-pronged approach" rather than treating Part 2-1 as a replacement for Part 1.
The UL 2900 series has three sector-specific Part 2 standards sitting alongside UL 2900-2-1: UL 2900-2-2 (industrial control system components — PLCs, SCADA, RTUs) and UL 2900-2-3 (electronic physical security and life-safety signalling systems). All four feed into the UL Cybersecurity Assurance Program (UL CAP), UL's certification program for network-connectable products, which — per UL's own description carried over from the Part 1 standard — evaluates products via static binary analysis against Common Weakness Enumerations (CWE), open-source and third-party library analysis, and structured penetration testing, and verifies that a vendor maintains sufficiently mature development and maintenance processes that future patches don't regress the certified security level.
FDA recognition: June 2018, not mandatory
UL's own 19 June 2018 announcement states plainly: "Device submissions to the FDA may now leverage testing and declarations of conformity to UL 2900-2-1 to streamline product review. The announcement follows the FDA's 2017 recognition of UL 2900-1 and provides manufacturers and developers with tools to meet the FDA's evolving expectations for medical device cybersecurity risk mitigation." Independent secondary reporting places the underlying FDA Recognized Consensus Standards database entry at Recognition Number 13-104, dated 7 June 2018, under the Software/Informatics category, for "Standard for Safety, Software Cybersecurity for Network-Connectable Products, Part 2-1 ... First Edition 2017" — this guide could not directly render the live FDA accessdata.fda.gov detail page during this fetch, so treat the exact Recognition Number as to be confirmed against FDA's own searchable database before citing it in a regulatory submission.
Recognition does not make certification mandatory. UL's own published Medical Device Cybersecurity Q&A states directly: "No, UL 2900-2-1 is not mandatory for FDA 510(k) submissions." What recognition buys a manufacturer is the option to cite conformance to a recognized consensus standard as part of a premarket cybersecurity submission, rather than having to justify a bespoke test methodology from scratch — the same mechanism, under the same FDA recognized-standards program, that applies to UL 2900-1 itself (see UL 2900-1).
A workable starting point
Pair Part 2-1 with Part 1, not instead of itUL 2900-2-1's healthcare-specific requirements build on UL 2900-1's general risk-management, testing-method and architectural-control requirements — plan a conformance effort around both documents, not Part 2-1 in isolation. Scope regulated and unregulated components togetherThe standard's own scope statement addresses integrated solutions combining regulated and unregulated parts — a connected health product with a regulated device core and an unregulated companion app should be assessed as one system, not split into separately-scoped reviews. Treat FDA recognition as a submission accelerator, not a requirementUL's own Q&A confirms certification isn't mandatory for 510(k) submissions — budget and timeline decisions should weigh the premarket-review efficiency UL describes against the cost of commercial certification, rather than treating UL 2900-2-1 as a compliance gate. Verify the exact edition before citing it in a submissionWith a 2023 revision layered onto the 2017 Edition 1 baseline, confirm which edition a purchased copy or a prior certification actually covers before referencing it in new regulatory paperwork. Confirm the FDA Recognition Number directly against FDA's own databaseThis guide's Recognition Number (13-104) comes from secondary reporting rather than a directly rendered FDA record — check it live before relying on it for a submission.
SoftWSP's device and firmware security assessments can help prepare the vulnerability, weakness and malware evidence a UL 2900-2-1-aligned review expects: see device firmware security.
This guide draws on UL's own published scope statement, FDA-recognition announcement and Q&A, and independent secondary summaries of UL 2900-2-1's commercial, purchase-only text; it is not a substitute for the full standard or regulatory/legal advice. Confirm the FDA Recognition Number and exact sub-requirement wording against FDA's and UL's own current records before relying on them for a submission.
Sources
- UL Standards & Engagement (shopULstandards.com): UL 2900-2-1, Edition 1 — product listing (title, publication date 2017-09-01, last revision/ANSI approval 2023-09-21, ICS code, price, scope description)
- ANSI Webstore: UL 2900-2-1 Ed. 1-2017 — Software Cybersecurity for Network-Connectable Products, Part 2-1 (revision published 2023-09-21)
- UL Solutions (ul.com): "U.S. FDA Recognizes UL 2900-2-1 for Use in Premarket Reviews" — 19 June 2018 company announcement (recognition date, relationship to UL 2900-1, premarket review use)
- UL Solutions (ul.com): Medical Device Cybersecurity Q&A — "No, UL 2900-2-1 is not mandatory for FDA 510(k) submissions"
- Black Duck (blackduck.com): "What Is UL 2900 and How Does It Work?" — UL 2900 series overview, UL 2900-2-1 scope, UL CAP description
- FDA: Recognized Consensus Standards database (accessdata.fda.gov/scripts/cdrh/cfdocs/cfstandards) — searchable primary record; this guide could not render a specific detail page during this fetch, so verify the live Recognition Number (reported as 13-104) directly here
Frequently asked questions
What is UL 2900-2-1, and who publishes it?
UL 2900-2-1, "Standard for Software Cybersecurity for Network-Connectable Products, Part 2-1: Particular Requirements for Network Connectable Components of Healthcare and Wellness Systems," is a certification standard published by UL Standards & Engagement (formerly Underwriters Laboratories) and adopted as an American National Standard (ANSI). It was first published and ANSI-adopted in September 2017 as Edition 1, with a revision published and ANSI-approved on 21 September 2023 (as ANSI/CAN/UL 2900-2-1) covering updates tied to changes in the parent UL 2900-1 standard. Like UL 2900-1, it is a commercial standard sold by UL and ANSI rather than published in full for free; this guide draws on the publicly available scope statement, UL's own FDA-recognition announcement, and corroborating secondary summaries rather than the full purchased requirement text — treat specific sub-requirement wording as **to be confirmed** against a purchased copy.
What does UL 2900-2-1 actually cover, per its own scope?
Per its catalogue listing on UL's own standards store, UL 2900-2-1 "applies to testing of network connectable components in healthcare systems, including medical devices, accessories, medical device data systems, in vitro diagnostic devices, health information technology, wellness devices, and associated software," and covers "all software components used for the secure operation of the device, wherever they may reside, including remote assets." The scope statement also addresses integrated solutions that combine regulated and unregulated components, rather than treating a device's regulated and unregulated software separately.
How does UL 2900-2-1 relate to UL 2900-1 and the rest of the UL 2900 series?
UL 2900-2-1 is a Part 2 sector-specific standard that sits on top of [UL 2900-1](/guides/ul-2900-1-software-cybersecurity/), the series' general, sector-agnostic Part 1 requirements. Per independent secondary summaries (CS2AI-style standards trackers and Black Duck's UL 2900 overview), UL 2900-2-1 relies on test procedures and risk-management structure established in UL 2900-1 and narrows them to healthcare-specific obligations — it is meant to be applied together with Part 1, not as a standalone replacement for it. It sits alongside UL 2900-2-2 (industrial control system components) and UL 2900-2-3 (physical security and life-safety signalling systems) as the series' other sector-specific parts, and all four feed into the UL Cybersecurity Assurance Program (UL CAP) certification program.
Has the FDA recognised UL 2900-2-1 for medical device submissions, and is certification mandatory?
Yes, recognition is confirmed, and no, certification is not mandatory. Per UL's own 19 June 2018 announcement, "Device submissions to the FDA may now leverage testing and declarations of conformity to UL 2900-2-1 to streamline product review. The announcement follows the FDA's 2017 recognition of UL 2900-1 and provides manufacturers and developers with tools to meet the FDA's evolving expectations for medical device cybersecurity risk mitigation." Independent secondary reporting places the FDA database entry at Recognition Number 13-104, dated 7 June 2018, under the Software/Informatics category, for "Standard for Safety, Software Cybersecurity for Network-Connectable Products, Part 2-1 ... First Edition 2017" — this guide was unable to directly render the live FDA accessdata.fda.gov detail page during this fetch, so treat the exact Recognition Number as **to be confirmed against FDA's live database**. UL's own published medical-device cybersecurity Q&A states plainly: "No, UL 2900-2-1 is not mandatory for FDA 510(k) submissions" — recognition lets a submission cite conformance to streamline review, it does not make certification a legal requirement.
In this cluster
