IoMT, the Internet of Medical Things, means connected medical devices and the systems around them, such as infusion pumps, monitors and imaging equipment. IoMT security is about keeping those devices safe from misuse without breaking patient care. In the US, manufacturers face cybersecurity requirements through FDA section 524B and related guidance.
Why is it different from ordinary IT security?
Patient safety is the first consideration. A device that must keep running cannot always be rebooted for a patch. Devices stay in service for years or decades, long after a vendor stops updating the software inside. Many were designed before connectivity was assumed, and many run on shared hospital networks beside everyday office systems.
So the usual advice, patch quickly and isolate, collides with clinical reality. You cannot take a ventilator offline during a shift to install an update.
What does the FDA require?
According to the FDA's cybersecurity page for medical devices, section 3305 of the Consolidated Appropriations Act, 2023, signed 29 December 2022, added section 524B to the Federal Food, Drug, and Cosmetic Act under the title Ensuring Cybersecurity of Medical Devices. The amendments took effect 90 days after enactment, on 29 March 2023.
The FDA issued final guidance titled Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions on 27 June 2025. It adds a section on 524B recommendations for cyber devices and supersedes the September 2023 version. It covers design, labeling and documentation for devices with cybersecurity risk. For devices already on the market, the FDA's postmarket guidance, issued 27 December 2016, recommends structured management of cybersecurity vulnerabilities throughout the product life cycle.
Read the statute and guidance directly for the exact obligations. This article does not restate every requirement, and the details depend on whether a device counts as a cyber device.
What are the main risks?
Unpatched software. Old operating systems and libraries inside the device with known flaws.
Weak access. Default or shared passwords, and remote service access left open.
Flat networks. A compromised workstation reaching clinical devices because nothing separates them.
Unknown inventory. Hospitals often lack a full list of connected devices and their software.
Third party components. Devices embed open source and vendor libraries whose flaws become the manufacturer's and hospital's problem.
Constructed example: the infusion pump network
A hospital ward has forty infusion pumps on the same network segment as nurse workstations. A workstation is infected through a phishing email and begins scanning the segment. The pumps run an old embedded operating system that cannot be updated mid shift. Because the pumps sit on their own restricted segment with only the required connections allowed, the scan finds nothing reachable, and care continues unaffected. Network segmentation did the work that patching could not. The setup is invented to illustrate the principle.
What helps on each side?
Manufacturers build security into design and keep an inventory of the components inside each device. A software bill of materials supports that, listing the open source and third party code so that when a flaw is published you can tell which products are affected. Safeguard's dependency scanning and SBOM support are aimed at that software inventory problem for makers who build device software.
Healthcare providers should inventory connected devices, segment them, restrict remote access, and keep a plan for devices that cannot be patched.
How to check or apply this
- Build an inventory of every connected medical device, its software and its network location.
- Segment clinical devices from general networks and allow only needed connections.
- Replace default passwords and restrict vendor remote access to approved, logged sessions.
- For makers: keep an SBOM per product and watch for new flaws in every component.
- Ask suppliers how long they will patch each device and how they notify you.
- Plan compensating controls for end of life devices.
- Read the FDA premarket and postmarket guidance if you make devices for the US market.
Quick check
What did section 524B add?
According to the FDA's page, it was added by the Consolidated Appropriations Act, 2023 under the heading Ensuring Cybersecurity of Medical Devices, and took effect on 29 March 2023.
What if a device cannot be patched?
Use compensating controls: segment it, restrict who and what can reach it, monitor traffic and plan replacement.
Sources
Last reviewed: 18 October 2026.
