FDA's postmarket cybersecurity guidance asks device makers to monitor for vulnerabilities, judge whether patient-harm risk is controlled or uncontrolled, and act on a clock for the uncontrolled ones: tell customers within 30 days and fix within 60. Joining an information sharing organization and documenting each decision are what auditors look for.
This describes the December 2016 final guidance for industry and FDA staff, which is nonbinding. Newer FDA premarket material exists, so check FDA's pages for current expectations.
What is controlled versus uncontrolled risk?
The guidance defines controlled risk as sufficiently low, acceptable residual risk of patient harm from a particular vulnerability. Uncontrolled risk is unacceptable residual risk of patient harm because compensating controls and risk mitigations are inadequate. The assessment weighs the likelihood of exploit and the impact on safety and essential performance. That judgment, written down with reasons, is the core record.
What happens when risk is controlled?
Routine updates and patches that address only controlled-risk vulnerabilities are treated as cybersecurity routine updates. The guidance describes them as changes to increase security and fix vulnerabilities with controlled risk of patient harm, and discusses reporting for them separately. Even so, keep the assessment on file, because the decision that risk is controlled is the thing you will be asked to defend.
What happens when risk is uncontrolled?
Manufacturers must report these vulnerabilities to FDA under 21 CFR part 806, with an exception FDA says it does not intend to enforce against when three conditions hold. First, there are no known serious adverse events or deaths tied to the vulnerability. Second, no later than 30 days after learning of it, the maker communicates with customers and users, identifies interim compensating controls and develops a remediation plan, documenting its timeline rationale. Third, no later than 60 days after learning of it, the maker fixes the vulnerability, validates the change and distributes the deployable fix so residual risk falls to an acceptable level. Compensating controls may sometimes be a long-term answer if risk becomes acceptable. In its example, a manufacturer that actively participates in an ISAO and shares information about the vulnerability there also falls under the non-enforcement position.
The customer message at the 30 day mark should, at minimum, describe the vulnerability with an impact assessment, say that work is under way, describe compensating controls if any, and say a fix or a defense-in-depth strategy is coming.
Why does the ISAO matter?
FDA strongly recommends that manufacturers take part in an information sharing and analysis organization that shares device vulnerabilities and threats. It also recommends adopting a coordinated vulnerability disclosure policy and mentions ISO/IEC 29147 as a useful resource. Postmarket information can arrive from researchers, in-house testing, suppliers, health care facilities and ISAOs, so intake needs a named owner.
How does this apply to software components?
Many device vulnerabilities live in third party software. Constructed example: a bedside monitor ships with an embedded web library. A new advisory affects it. The team needs to know which firmware versions include that library, whether the vulnerable code is reachable on the device, and what the patient-harm path would be. Without a component inventory per firmware release, the 30 day clock burns on discovery instead of decisions.
What to do
- Keep a component list for every released firmware and software version.
- Watch advisories for those components continuously, not at release time.
- Write the controlled versus uncontrolled assessment for each relevant vulnerability, with reasons.
- Draft a customer communication template that fits the 30 day content list.
- Plan patch validation so a fix can ship inside 60 days.
- Join an ISAO and publish a vulnerability disclosure policy.
- Keep records that show dates: when you learned, assessed, told and fixed.
Safeguard produces SBOMs and ties advisories to components, which supports steps one and two. It does not make a device compliant with FDA expectations.
Quick check
What are the 30 and 60 day marks?
For uncontrolled risk, FDA says customer communication and a remediation plan within 30 days, and a validated fix distributed within 60 days, as conditions for its non-enforcement position on part 806 reporting.
Is the guidance a legal requirement?
It is nonbinding recommendations, but it cites binding rules such as 21 CFR part 806. Treat it as the benchmark auditors use.
Sources
- FDA, Postmarket Management of Cybersecurity in Medical Devices (Dec 2016)
- FDA guidance document (PDF)
Last reviewed: 18 October 2026.
