Medical device cybersecurity for connected and software-driven devices
For makers of connected or software-driven medical devices sold in the US or EU. A device with network or software capability usually counts as a "cyber device" under FDA rules, or a product with digital elements under the EU Cyber Resilience Act — both mean an SBOM, a vulnerability-monitoring plan and a patch process before a regulator accepts the submission. SoftWSP's device and firmware security service produces that SBOM and vulnerability report from your firmware image.
Regulations and standards that apply
- FDA premarket cybersecurity — Section 524B, FD&C Act. In force since 29 March 2023: a qualifying "cyber device" submission needs an SBOM, a plan to monitor and address postmarket vulnerabilities (including coordinated disclosure), and a process to ship patches, or FDA can refuse to accept the submission for review.
- EU Cyber Resilience Act — Regulation (EU) 2024/2847. Sets SBOM, vulnerability-handling and Article 14 reporting duties for products with digital elements; it excludes products already covered by sector-specific EU law with the same objectives, including devices already regulated by the EU Medical Devices Regulation and In Vitro Diagnostic Medical Devices Regulation — check the current text for which of your products that covers.
- FDA postmarket cybersecurity guidance (2016). Sets out what FDA expects once a device has shipped: ongoing vulnerability monitoring, coordinated disclosure and a patching process, the same areas 524B now requires evidence of at the premarket stage.
Typical device and firmware risks
- Outdated or unpatched third-party and open-source components bundled into the device's firmware or embedded OS.
- An SBOM that is missing, incomplete, or not kept current as firmware updates ship — the gap FDA's refuse-to-accept policy is built to catch.
- No coordinated vulnerability disclosure policy or named security contact for a researcher to reach.
- Unauthenticated or weakly authenticated wireless or Bluetooth interfaces used for pairing or firmware updates.
- Hard-coded credentials, debug interfaces or test backdoors left enabled in production firmware.
Which SoftWSP service fits
Device & Firmware Security scans your firmware image and produces the SBOM and vulnerability report a 524B submission or a CRA technical file needs, with findings prioritised by CISA KEV and FIRST EPSS rather than CVSS score alone. If you build the machine or cart a device is mounted in rather than the device's own firmware, see Machine Builders instead — that service covers one assembled machine line, not device firmware.
Related
- FDA premarket cybersecurity for medical devices: Section 524B explained
- Firmware SBOM
- CVE-2026-97851: J4Care dcm4chee-arc-light — a real flaw in medical-imaging archive software, as a working example of what a firmware/software scan is looking for.
Frequently asked questions
What counts as a 'cyber device' under FDA's rules?
Section 524B(c) of the FD&C Act defines a cyber device as one that includes software validated, installed or authorized by the sponsor, can connect to the internet, and contains technology that could be vulnerable to cybersecurity threats — the definition FDA's own guidance restates for premarket submissions.
Does the EU Cyber Resilience Act also cover medical devices?
Regulation (EU) 2024/2847 sets general cybersecurity requirements for 'products with digital elements', but it excludes products already regulated by sector-specific EU law covering the same objectives — including devices already regulated under the EU Medical Devices Regulation (EU) 2017/745 and the In Vitro Diagnostic Medical Devices Regulation (EU) 2017/746. Which exclusion applies to a given product needs checking against the current CRA text.
Does FDA require one specific SBOM format?
No. FDA's premarket guidance does not mandate a single format; it expects a machine-readable SBOM naming each software component, its version and its supplier, in a format such as SPDX, CycloneDX or SWID.
Since when has FDA enforced the cyber device premarket requirement?
Section 524B took effect 90 days after enactment, on 29 March 2023 (Public Law 117-328); submissions made before that date are not subject to it, and FDA's refuse-to-accept policy applies to qualifying submissions made on or after it.
Does SoftWSP test or certify our medical device?
No. The report is based on the firmware image and component information you share with us. We do not connect to, test or certify your device, and we make no claim that a report by itself makes a device compliant with FDA or EU rules.
Sources
- Public Law 117-328 (Consolidated Appropriations Act, 2023), Division FF, Title III, §3305 — FD&C Act Section 524B (read 29 Oct 2026)
- FDA: Cybersecurity in Medical Devices — Quality Management System Considerations and Content of Premarket Submissions (guidance, read 29 Oct 2026)
- FDA: Postmarket Management of Cybersecurity in Medical Devices (guidance, December 2016, read 29 Oct 2026)
- Regulation (EU) 2024/2847 (Cyber Resilience Act), Official Journal text, EUR-Lex (read 29 Oct 2026)