Guidance on cybersecurity for medical devices

The guidance frames cybersecurity as part of the safety and performance requirements, not as an IT concern. Manufacturers must demonstrate that reasonably foreseeable threats have been considered and that residual risk has been evaluated in the risk management file.

Secure design expectations include minimising the attack surface, applying least privilege, protecting stored and transmitted data, and defining how the device behaves when connectivity is lost. Verification should include penetration testing proportionate to the risk and to the exposure of the device.

Documentation should describe the security architecture, the software bill of materials, and the process for receiving and triaging vulnerability reports. Manufacturers must also state the minimum hardware and software requirements and the expected support period.

Post-market obligations include monitoring for publicly disclosed vulnerabilities, assessing their impact, and issuing coordinated patches. Communication with users about security updates should be clear about clinical impact, because a patch that requires revalidation may not be deployed immediately.