New medical device cybersecurity requirements under section 524B of the US Federal Food, Drug, and Cosmetic Act take effect today, 90 days after the Consolidated Appropriations Act 2023 was signed.
Key points
- Premarket submissions for “cyber devices” must include a plan to monitor, identify and address post-market vulnerabilities.
- Manufacturers must have processes to design, develop and maintain devices securely, including coordinated vulnerability disclosure.
- A software bill of materials (SBOM), including commercial, open-source and off-the-shelf components, is required.
- Updates and patches must be made available on a reasonable schedule.
UK medical device manufacturers and software suppliers targeting the US market should build these requirements into their development lifecycle and regulatory submissions.
Source: Cybersecurity in Medical Devices FAQs, section 524B (FDA)
Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.
