Keyfactor Tech Days 2027 – Be Part of The Trust Security Conference in San Diego Register now!

FDA Guidance

FDA Medical Device Cybersecurity Guidance

Updated: August 24, 2026
Back to Compliance Hub

Table of Contents

Reading progress

0%
Guide Cryptographic Compliance Guide for Manufacturing Download now
Region United States (applies to premarket submissions to the FDA; widely referenced internationally as a benchmark for connected medical device security) 
Applicability Medical Device Manufacturers: sponsors submitting 510(k), PMA, PDP, De Novo, or HDE applications for devices that meet the definition of a “cyber device” Software and Component Suppliers: providers of software, including open-source and off-the-shelf components, integrated into cyber devices and subject to SBOM disclosure Healthcare Delivery Organizations: hospitals and providers responsible for maintaining the postmarket cybersecurity of deployed devices under a shared-responsibility model 
Relevant sections FD&C Act §524B: Cybersecurity requirements for cyber devices, added by the PATCH Act, effective March 29, 2023 FDA Final Guidance (June 27, 2025): “Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions,” replacing the September 2023 version §524B(b): Postmarket vulnerability monitoring, coordinated vulnerability disclosure, Software Bill of Materials, and update and patch requirements 

Overview

Section 524B of the FD&C Act, added by the PATCH Act as part of the Consolidated Appropriations Act, 2023, requires premarket submissions for “cyber devices”, devices containing software that can connect to the internet and that have technological characteristics that could be vulnerable to cybersecurity threats, to include a cybersecurity plan, a postmarket vulnerability monitoring process, and a Software Bill of Materials (SBOM). 

FDA’s June 27, 2025 final guidance replaced the September 2023 version and details the quality-system and content expectations for these submissions, including encryption, authentication, firmware signing, and key management, emphasizing secure implementation over the mere selection of an approved algorithm. 

Why It Matters 

Since March 29, 2023, encryption, authentication, and key-management documentation is a legal precondition for a premarket submission to even be accepted, not a recommendation: FDA can issue a Refuse to Accept determination for a cyber device submission that lacks the required §524B information. 

The largest compliance exposure sits in the already-deployed installed base, devices built before 2023 that often rely on shared keys or static credentials, and hospitals are increasingly requesting SBOM and cryptographic evidence during procurement itself, making this a commercial access issue for hospital contracts as well as a regulatory one for FDA clearance.

How This Maps to Cryptography 

Section 524B addresses cryptography primarily through its premarket cybersecurity plan and postmarket vulnerability management requirements. The key control areas with direct cryptographic implications are: 

Section Function What it says Products
§524B(b) — Cybersecurity plan; secure design Secure Communications (Data in Transit) Certificate-based mutual TLS between the device, companion apps, and cloud services, protecting the confidentiality and integrity of PHI and control commands EJBCA 
§524B(b) — Reasonable assurance the device is cybersecure Device Identity and Authentication Unique, per-device cryptographic identity replacing shared or default credentials common in legacy implants and bedside devices Command 
§524B(b) — Mandatory postmarket update and patch process Secure Firmware and Software Update Signing Cryptographic signing and verification of firmware and software updates before installation SignServer / Signum 
§524B(b) — Software Bill of Materials Cryptographic Component Inventory Inventory of cryptographic libraries and algorithms embedded in device software, feeding the required SBOM AgileSec 
June 2025 Final Guidance — Key management practices Key Management Across the Device Lifecycle Documented key generation, rotation, and revocation procedures spanning a device’s multi-year deployed lifetime, including field-deployed legacy units Command 
June 2025 Final Guidance — On-device storage protection Secure Data at Rest Encryption of stored patient data and configuration on the device itself, with keys managed independently of intermittent connectivity EJBCA 

Audit Readiness 

FDA premarket review of cyber devices, and increasingly hospital procurement review of already-cleared devices, focuses on demonstrated cryptographic implementation rather than a stated intent to encrypt. Key areas reviewers probe: 

  • Cyber Device Determination: Has the organization documented why a device is, or is not, a “cyber device” under §524B(c), consistently across the submission? 
  • Encryption and Authentication Evidence: Can the sponsor demonstrate specific encryption methods and authentication mechanisms protecting data in transit, at rest, and during device pairing? 
  • Firmware Signing Verification: Is there evidence that firmware and software updates are cryptographically signed and verified before installation? 
  • SBOM Completeness: Does the Software Bill of Materials identify commercial, open-source, and off-the-shelf components, including their cryptographic libraries? 
  • Post-market Vulnerability Monitoring Plan: Is there a documented plan, including coordinated vulnerability disclosure, to monitor and address cybersecurity vulnerabilities after the device ships? 
  • Legacy Device Compensating Controls: For already-deployed devices that cannot natively support strong cryptography, are compensating controls identified and documented in the postmarket management plan?

TAKE THIS TO MANAGEMENT

Since March 2023, Section 524B has made cybersecurity documentation, including our encryption and key-management approach, a legal precondition for the FDA to even accept a premarket submission. The June 2025 final guidance is explicit that selecting an encryption method isn’t enough; we have to show secure implementation, from firmware signing to key lifecycle management.

Our biggest exposure sits in the installed base: devices built before 2023 that rely on shared keys or static credentials. Those units aren’t going away, and hospitals are starting to ask for SBOM and cryptographic evidence during procurement, not just at FDA submission. Closing that legacy gap, with unique credentials and a documented key lifecycle, is what keeps us eligible for both regulatory clearance and hospital contracts.

Related Compliances