FDA Issues Final Guidance On Postmarket Management Of Cybersecurity In Medical Devices

The Food and Drug Administration (FDA) recently issued a final guidance titled "Postmarket Management of Cybersecurity in Medical Devices." The guidance applies to "(1) medical devices that contain software (including firmware) or programmable logic, and (2) software that is a medical device, including mobile medical applications." In an expansion from the draft version, the final guidance also applies to devices that are part of an interoperable system and "legacy" devices, i.e., devices already on the market or in use.

According to the FDA, medical devices are increasingly connected to computer networks to facilitate patient care and, as a result, may be vulnerable to cybersecurity threats. The guidance "emphasizes that manufacturers should monitor, identify and address cybersecurity vulnerabilities and exploits as part of their postmarket management of medical devices."