GUIDANCE DOCUMENT
Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions Draft Guidance for Industry and Food and Drug Administration Staff April 2022
Not for implementation. Contains non-binding recommendations.
This guidance is being distributed for comment purposes only.
Submit Comments by
Although you can comment on any guidance at any time (see 21 CFR 10.115(g)(5)), to ensure that the FDA considers your comment on a draft guidance before it begins work on the final version of the guidance, submit either online or written comments on the draft guidance before the close date.
If unable to submit comments online, please mail written comments to:
Dockets Management
Food and Drug Administration
5630 Fishers Lane, Rm 1061
Rockville, MD 20852
All written comments should be identified with this document's docket number: FDA-2021-D-1158
- Docket Number:
- FDA-2021-D-1158
- Issued by:
-
Guidance Issuing OfficeCenter for Devices and Radiological Health
The need for effective cybersecurity to ensure medical device functionality and safety has become more important with the increasing use of wireless, Internet- and network- connected devices, portable media (e.g. USB or CD), and the frequent electronic exchange of medical device-related health information. In addition, cybersecurity threats to the healthcare sector have become more frequent, more severe, and more clinically impactful. Cybersecurity incidents have rendered medical devices and hospital networks inoperable, disrupting the delivery of patient care across healthcare facilities in the US and globally. Such cyberattacks and exploits can delay diagnoses and/or treatment and may lead to patient harm.
This guidance is intended to provide recommendations to industry regarding cybersecurity device design, labeling, and the documentation that FDA recommends be included in premarket submissions for devices with cybersecurity risk. These recommendations can facilitate an efficient premarket review process and help ensure that marketed medical devices are sufficiently resilient to cybersecurity threats.
Although FDA issued final guidance addressing premarket expectations in 2014 and a draft guidance in 2018, the rapidly evolving landscape, and the increased understanding of the threats and their potential mitigations, necessitates an updated approach. The FDA has incorporated input from stakeholders at various public meetings, comments from Docket FDA-2018-D-3443, and recommendations from the Health Care Industry Cybersecurity (HCIC) Task Force Report to revise this guidance to identify issues related to cybersecurity that manufacturers should address in the design and development of their medical devices as well as in preparing premarket submissions for those devices.