U.S. flag An official website of the United States government
  1. Home
  2. Regulatory Information
  3. Search for FDA Guidance Documents
  4. Content of Premarket Submissions for Management of Cybersecurity in Medical Devices
  1. Regulatory Information

GUIDANCE DOCUMENT

Content of Premarket Submissions for Management of Cybersecurity in Medical Devices Guidance for Industry and Food and Drug Administration Staff October 2018

Draft

Not for implementation. Contains non-binding recommendations.

Content of Premarket Submissions for Management of Cybersecurity in Medical Devices

Docket Number:
FDA-2018-D-3443
Issued by:
Guidance Issuing Office
Center for Devices and Radiological Health

The need for effective cybersecurity to ensure medical device functionality and safety has become more important with the increasing use of wireless, Internet- and network- connected 84devices, portable media (e.g. USB or CD), and the frequent electronic exchange of medical device-related health information. In addition, cybersecurity threats to the healthcare sector have become more frequent, more severe, and more clinically impactful. Cybersecurity incidents have rendered medical devices and hospital networks inoperable, disrupting the delivery of patient care across healthcare facilities in the US and globally. Such cyberattacks and exploits can delay diagnoses and/or treatment and may lead to patient harm.

This guidance is intended to provide recommendations to industry regarding cybersecurity device design, labeling, and the documentation that FDA recommends be included in premarket submissions for devices with cybersecurity risk. These recommendations can facilitate an efficient premarket review process and help ensure that marketed medical devices are sufficiently resilient to cybersecurity threats.

Although FDA issued final guidance addressing premarket expectations in 2014, the rapidly evolving landscape, and the increased understanding of the threats and their potential mitigations, necessitates an updated approach. This guidance has been developed by the FDA to assist industry by identifying issues related to cybersecurity that manufacturers should address in the design and development of their medical devices as well as in preparing premarket submissions for those devices.


Submit Comments

You can submit online or written comments on any guidance at any time (see 21 CFR 10.115(g)(5))

If unable to submit comments online, please mail written comments to:

Division of Dockets Management (HFA- 305)
Food and Drug Administration
5630 Fishers Lane, Rm. 1061
Rockville, MD 20852

All written comments should be identified with this document's docket number: FDA-2018-D-3443.