Designing medical device updates: a checklist from FDA's guidance

FDA's guidance expects devices to be updatable in a secure and timely way. The design points are cryptographically authenticated updates, rollback protection, safe behavior if an update is interrupted, security patches independent of feature releases, and preserved build and test tooling so a patch years later can be built and verified.

Plan for the patch before the vulnerability

The guidance says undiscovered, exploitable vulnerabilities may exist after marketing, and threats change over a device's service life. Manufacturers should build in updateability and plan for rapid testing, evaluation and patching of deployed devices. It also notes that this likely needs extra storage space and processing resources, which are hard to add later.

Checklist

Authenticate what gets installed

• Verify signatures or MACs on firmware and software, along with version numbers and metadata.
• Install only cryptographically authenticated updates, and refuse installation when authentication is absent or fails.
• Sign the version numbers intended to be installed, so an old signed image cannot masquerade as a new one.

Control downgrades

• Do not allow downgrades or version rollbacks unless absolutely necessary for safety, and log and document any such event.
• One approach in the guidance for authorized downgrades is to sign new metadata for each downgrade request, since these happen only in exceptional cases.

Survive failure

• Consider how the process behaves if communication is interrupted, including the timing of hardware effects and the phase of the update when the failure occurs.

Keep security patches separate

• Consider security patches and updates independent of regular feature update cycles.
• Build processes, technologies and exercises that speed verification, validation and distribution of patches.

Preserve the means to build

• Keep full build environments and virtual machines, regression test suites, development kits, emulators, debuggers and related tools used for the original product.
• Maintain the third party licenses needed throughout the supported life.
• Plan for a supplier going out of business or ending support, and consider modular designs so third party parts can be replaced.

Deliver to users

• Provide a secure process and mechanism for giving users validated updates and patches.

The whole path counts

In the architecture guidance, FDA describes the update path as end to end. Pushing from an update server to a clinic programmer crosses networks and tools the manufacturer does not control, so the design must protect the path and account for the added risk. See the four architecture views.

Test it like any other control

An update mechanism is a security control, and FDA expects controls to be tested. Include update tampering, replay of old images and interrupted installs in your test plan, and keep the results for the submission.

Quick check

Sources

• FDA guidance, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 3, 2026)

Last reviewed: 19 October 2026.