FDA Proposes Updated Guidance Concerning Cybersecurity Of Medical Devices

The U.S. Food and Drug Administration ("FDA") has proposed updated guidance, intended to assist individuals in meeting the cybersecurity requirements for FDA medical device submissions.

On March 13, 2024, FDA released the draft Premarket Cybersecurity Guidance, proposing select supplementary updates to the final guidance "Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions." This draft guidance identifies the information FDA generally considers necessary to support premarket submission obligations concerning the cybersecurity of medical devices.

Such obligations are established by Section 524B of the Federal Food, Drug, and Cosmetic Act, and apply to any submission, including a 510(k), PMA, PDP, De Novo, or HDE, for a "Cyber Device." The updates clarify that a Cyber Device: (i) is or contains software, including software that is firmware or programable logic; (ii) can connect to the internet, intentionally or not;