The regulatory landscape for medical device cybersecurity has been shifting rapidly. The U.S. Food and Drug Administration updated its premarket submission guidance on cybersecurity in March 2026, replacing the version issued in June 2025 and bringing the agency’s expectations into closer alignment with both its Quality Management System Regulation and the framework established by the International Medical Device Regulators Forum in 2020.
For device manufacturers, this is not a marginal revision. The updated guidance reflects a maturing regulatory philosophy around device security that has significant implications for how manufacturers design, document, and submit products to the FDA. Understanding what changed and what it means in practice is essential for any organization with medical devices in development or approaching premarket submission.
Why the FDA Updated the Guidance Again
The FDA’s June 2025 cybersecurity guidance was itself a substantial update to earlier versions. The March 2026 revision reflects two primary drivers.
First, the FDA’s Quality Management System Regulation, or QMSR, took effect in February 2026 after years of development. The QMSR represents a fundamental restructuring of the FDA’s quality system requirements for medical devices, aligning them with the ISO 13485:2016 international standard. That alignment created the need to update the cybersecurity guidance to reflect how cybersecurity risk management fits within the QMSR framework rather than the older Quality System Regulation it replaced.
Second, the updated guidance now generally aligns with or expands upon the March 2020 IMDRF guidance on medical device cybersecurity. That international alignment matters because device manufacturers increasingly operate in global markets and must satisfy cybersecurity requirements from multiple regulatory bodies. Aligning the FDA’s guidance with the IMDRF framework reduces the compliance burden for manufacturers seeking international market access while also raising the floor on what the FDA expects.
The Secure Product Development Framework: A Central Concept
One of the most significant features of the updated guidance is its explicit recommendation that device manufacturers adopt and implement a Secure Product Development Framework, or SPDF.
The FDA defines an SPDF as a set of processes that reduces the number and severity of vulnerabilities in products throughout the device lifecycle. The concept is not new — the security development lifecycle has been a best practice in software development for years — but the FDA’s formal incorporation of it into premarket guidance represents a meaningful elevation of expectations.
An SPDF encompasses security activities throughout the design and development process rather than treating security as an add-on that is evaluated at the time of submission. That lifecycle orientation is central to the QMSR framework: risk management in the QMSR is explicitly described as identifying, analyzing, evaluating, controlling, and monitoring risk throughout the product lifecycle.
For manufacturers, adopting an SPDF means integrating security into requirements definition, architecture and design review, implementation practices, verification and validation, and post-market monitoring. It means that the security artifacts included in a premarket submission are not produced by a late-stage security assessment but are the outputs of a structured development process that began early in the product lifecycle.
What the Updated Guidance Expects in Premarket Submissions
The updated guidance expands and clarifies what cybersecurity documentation should be included in premarket submissions across device classifications. While the specific documentation requirements vary by submission type, the guidance identifies several core elements.
Threat Modeling
Manufacturers are expected to demonstrate that they have systematically identified potential threats to the device, analyzed the attack surface, and evaluated the impact of successful attacks on patient safety and device functionality. Threat modeling is expected to be conducted early in the development process and updated as the design evolves, not performed as a final step before submission.
Security Architecture Documentation
The submission should include documentation of security architecture decisions, including the identification of security boundaries, the mechanisms used to protect data in transit and at rest, access control implementations, and the rationale for security design choices. This documentation should show that security was designed in rather than bolted on.
Software Bill of Materials
The updated guidance reaffirms the FDA’s expectation that manufacturers include a Software Bill of Materials, or SBOM, in premarket submissions. An SBOM identifies all software components incorporated in the device, including third-party and open-source libraries, and enables the FDA and healthcare delivery organizations to assess exposure when new vulnerabilities are discovered in those components.
The requirement for SBOM disclosure has become increasingly important as the healthcare sector has experienced significant incidents involving vulnerabilities in software components that device manufacturers incorporated without full visibility into the supply chain risks they introduced.
Vulnerability Management Plan
Manufacturers must describe their post-market processes for identifying, assessing, and addressing vulnerabilities discovered after the device is deployed. The guidance emphasizes that cybersecurity risk management does not end at market clearance or approval — devices in the field remain active attack surfaces, and manufacturers have ongoing obligations to monitor for and respond to emerging threats.
The vulnerability management plan should describe how the manufacturer will receive vulnerability reports, how it will assess their severity and applicability, how it will develop and deploy patches or mitigations, and how it will communicate with customers and regulators about significant vulnerabilities.
Testing Documentation
The guidance expects manufacturers to demonstrate that their devices have been tested against identified threats. Testing documentation should include the methodology used, the scope of testing, the results, and how identified findings were addressed before submission.
The FDA has been explicit that testing by the manufacturer’s internal team alone may not be sufficient for higher-risk devices. Independent or third-party security testing can strengthen a submission by demonstrating that the device’s security posture has been evaluated by a party without a financial interest in the outcome.
The QMSR Connection: Security as Quality
One of the more conceptually important aspects of the updated guidance is how it situates cybersecurity within the QMSR framework. Under the QMSR, quality management encompasses the processes by which manufacturers identify and control risks throughout the device lifecycle. Cybersecurity risk is explicitly within scope.
This has a significant practical implication. Manufacturers who have established mature quality management systems under the QMSR cannot treat cybersecurity as a separate compliance discipline managed independently. Cybersecurity risk management must be integrated into the same processes used for other risk management activities — design controls, risk analysis, validation, and post-market surveillance.
For manufacturers that have built their cybersecurity compliance programs as standalone functions separate from quality management, the QMSR-aligned approach will require structural integration. That integration is not merely administrative; it reflects a substantive understanding that device security failures are quality failures with patient safety consequences.
International Alignment: The IMDRF Framework
The updated guidance’s alignment with the International Medical Device Regulators Forum framework has direct relevance for manufacturers seeking regulatory approval in multiple markets.
The IMDRF’s 2020 cybersecurity guidance established principles that have since been adopted or referenced by regulatory authorities in Canada, Australia, the European Union, Japan, and other major markets. Manufacturers building to the FDA’s updated guidance will find substantial overlap with requirements in those markets, reducing the burden of maintaining separate security programs for different regulatory jurisdictions.
Where differences exist — and they do, particularly around submission documentation formats and specific technical requirements — manufacturers should maintain clear mapping documentation that shows how their security program addresses each jurisdiction’s specific requirements. The alignment of frameworks reduces redundancy but does not eliminate jurisdiction-specific nuances.
Post-Market Cybersecurity Obligations
The updated guidance reinforces that the FDA’s cybersecurity expectations do not end at market clearance. Post-market cybersecurity is an ongoing obligation that the agency has been increasingly willing to enforce through recalls, safety communications, and enforcement actions.
Manufacturers must maintain active vulnerability monitoring programs that track publicly disclosed vulnerabilities in components used in their devices, threat intelligence sources relevant to their device categories, and healthcare sector-specific threat intelligence from sources such as the Health-ISAC.
When significant vulnerabilities are identified in deployed devices, manufacturers face decisions about whether and how to notify customers, whether to issue patches or mitigations, and whether the situation requires reporting to the FDA. The FDA’s guidance on when cybersecurity issues require regulatory reporting has evolved alongside its premarket guidance, and manufacturers should ensure their post-market surveillance processes include a clear escalation path for security issues.
The Healthcare Delivery Organization Perspective
While the updated guidance is directed at device manufacturers for premarket submissions, its requirements have direct implications for healthcare delivery organizations — hospitals, health systems, and other care settings that deploy and maintain medical devices.
Healthcare delivery organizations depend on manufacturers to provide timely and accurate security information, including SBOMs, vulnerability disclosures, and patch support. The FDA’s guidance creates regulatory expectations that support those needs. Manufacturers who fail to maintain active post-market security programs and communicate clearly about device vulnerabilities face both regulatory exposure and reputational consequences with health system customers who are themselves subject to cybersecurity regulations.
For healthcare delivery organizations evaluating devices for procurement, the FDA’s updated guidance provides a useful framework for assessing vendor security maturity. A manufacturer that can demonstrate a mature SPDF, comprehensive SBOM, and active vulnerability management program is making a more credible security commitment than one whose security documentation was assembled primarily to satisfy a regulatory requirement.
The device security space as a whole has moved toward greater accountability, and the FDA’s updated premarket guidance is one component of a broader framework that includes post-market surveillance expectations, healthcare sector cybersecurity guidance from CISA and HHS, and the evolving expectations of health system customers who have learned from painful experience that insecure devices are a significant liability.
You can assess device risk exposure specific to your environment using tools like DeviceRisk, which evaluates medical device cybersecurity risks in the context of healthcare compliance requirements.
What Manufacturers Should Do Now
Manufacturers with devices in development or approaching submission should take several immediate steps in light of the updated guidance.
Review your current security documentation against the updated guidance requirements. If your security artifacts were developed against the June 2025 guidance, assess where the March 2026 update introduces new expectations or clarifies existing ones.
Evaluate your SPDF maturity. If your security program consists primarily of end-stage security assessments rather than integrated lifecycle security processes, building toward a structured SPDF will strengthen both your submissions and your post-market security posture.
Ensure your SBOM processes are operational. Generating and maintaining accurate SBOMs requires visibility into the software supply chain that many manufacturers have not historically maintained systematically. Building those processes now is less disruptive than scrambling to satisfy a submission requirement.
Review your post-market vulnerability management processes. The FDA’s expectations for post-market cybersecurity are as important as its premarket submission requirements. Manufacturers who lack mature vulnerability monitoring and response programs are exposed on both sides of the regulatory relationship.
Engage with the FDA if you have questions about specific submission expectations. The agency’s digital health center of excellence provides resources and feedback mechanisms for manufacturers navigating complex cybersecurity submission questions. Engaging early in the process is consistently preferable to discovering deficiencies during a submission review.
This article is provided for informational purposes only and does not constitute legal or regulatory advice. Medical device manufacturers should consult qualified regulatory and legal counsel regarding their specific obligations under FDA cybersecurity guidance and related regulations.
