--- title: "Compare Medical Device Cybersecurity Rules Side by Side" url: https://mdccrosswalk.com/compare description: "Stack any 5 of 29 jurisdictions head-to-head: legal framework, SBOM, vulnerability disclosure, post-market & penalties. FDA, EU MDR, PMDA & more." lang: en --- Side by side # Pick your markets. See the deltas. Select up to five jurisdictions to put their cybersecurity expectations head to head. Click any column header to drill into the full profile. Last updated · July 25, 2026 Share Status key Mandatory Statutory or binding regulation. Non-compliance blocks market access. Guidance Non-statutory guidance. Typically enforced via review and registration. Emerging Framework adopted but not yet fully enforced or in active implementation. Filters 38 / 38 jurisdictions match current filters Cybersecurity diligence ranking ### Which regulators demand the most rigorous cybersecurity evidence? Composite score (0-100) computed from 29 weighted requirements in the FDA translation matrix. Weightings prioritize dimensions that actually change security posture - threat modeling, SBOM/vuln mapping, testing, CVD, patching, incident reporting - over paperwork-only obligations. | # | Jurisdiction | Diligence score | Tier | Required / Expected | Top gaps vs FDA | | --- | --- | --- | --- | --- | --- | | 1 | FDA 524B FDA / CDRH https://mdccrosswalk.com/standards/fda | 154 | Tier 1 - Rigorous | 24 req · 5 exp | Matches FDA rigor | | 2 | NMPA NMPA https://mdccrosswalk.com/standards/cn | 146 | Tier 1 - Rigorous | 20 req · 8 exp | - Security architecture views (global / multi-patient / updateability) | | 3 | MFDS MFDS https://mdccrosswalk.com/standards/kr | 128 | Tier 1 - Rigorous | 6 req · 21 exp | - Security architecture views (global / multi-patient / updateability) | | 4 | EU MDR EC / MDCG https://mdccrosswalk.com/standards/eu | 127 | Tier 1 - Rigorous | 7 req · 20 exp | - Security architecture views (global / multi-patient / updateability) | | 5 | MHRA MHRA https://mdccrosswalk.com/standards/uk | 122 | Tier 1 - Rigorous | 3 req · 24 exp | - Security architecture views (global / multi-patient / updateability) | | 6 | Health Canada Health Canada https://mdccrosswalk.com/standards/ca | 121 | Tier 1 - Rigorous | 3 req · 23 exp | - Security architecture views (global / multi-patient / updateability) | | 7 | Swissmedic Swissmedic https://mdccrosswalk.com/standards/ch | 121 | Tier 1 - Rigorous | 3 req · 23 exp | - Security architecture views (global / multi-patient / updateability) | | 8 | TFDA Cyber TFDA https://mdccrosswalk.com/standards/tw | 120 | Tier 1 - Rigorous | 3 req · 22 exp | - Security architecture views (global / multi-patient / updateability) | | 9 | HSA HSA https://mdccrosswalk.com/standards/sg | 117 | Tier 1 - Rigorous | 3 req · 21 exp | - SBOM tied to known vulnerabilities + support status - Security architecture views (global / multi-patient / updateability) | | 10 | PMDA PMDA / MHLW https://mdccrosswalk.com/standards/jp | 114 | Tier 1 - Rigorous | 3 req · 19 exp | - Machine-readable SBOM (SPDX or CycloneDX) - SBOM tied to known vulnerabilities + support status - Security architecture views (global / multi-patient / updateability) | | 11 | TGA TGA https://mdccrosswalk.com/standards/au | 95 | Tier 1 - Rigorous | 3 req · 3 exp | - Threat model with device-specific attack surface - Machine-readable SBOM (SPDX or CycloneDX) - SBOM tied to known vulnerabilities + support status | | 12 | CDSCO CDSCO https://mdccrosswalk.com/standards/in | 91 | Tier 1 - Rigorous | 2 req · 4 exp | - Threat model with device-specific attack surface - Machine-readable SBOM (SPDX or CycloneDX) - SBOM tied to known vulnerabilities + support status | | 13 | AMAR AMAR / MoH https://mdccrosswalk.com/standards/il | 91 | Tier 1 - Rigorous | 2 req · 2 exp | - Threat model with device-specific attack surface - Machine-readable SBOM (SPDX or CycloneDX) - SBOM tied to known vulnerabilities + support status | | 14 | SFDA SFDA https://mdccrosswalk.com/standards/sa | 86 | Tier 1 - Rigorous | 1 req · 4 exp | - Threat model with device-specific attack surface - Machine-readable SBOM (SPDX or CycloneDX) - SBOM tied to known vulnerabilities + support status | | 15 | ANVISA ANVISA https://mdccrosswalk.com/standards/br | 84 | Tier 2 - Substantive | 1 req · 3 exp | - Threat model with device-specific attack surface - Machine-readable SBOM (SPDX or CycloneDX) - SBOM tied to known vulnerabilities + support status | | 16 | MOHAP MOHAP / DHA / DoH https://mdccrosswalk.com/standards/ae | 81 | Tier 2 - Substantive | 0 req · 3 exp | - Threat model with device-specific attack surface - Machine-readable SBOM (SPDX or CycloneDX) - SBOM tied to known vulnerabilities + support status | Not sure how to use this? Try the journey planner (https://mdccrosswalk.com/planner) to turn these scores into a sequenced submission roadmap. The Crosswalk An independent reference for global medical device cybersecurity standards. A field guide for MedTech innovators and RA/QA teams charting an international path. Resource - Comparison matrix: https://mdccrosswalk.com/compare - Global playbook: https://mdccrosswalk.com/playbook - Glossary: https://mdccrosswalk.com/glossary - FAQ: https://mdccrosswalk.com/faq Sponsored by Blue Goat Cyber ↗ (https://bluegoatcyber.com/) Editorially independent. Sponsorship keeps it free. © 2026 The Crosswalk. Not legal advice. Validate every requirement against current regulator publications. ## Structured data ```json [ { "@context": "https://schema.org", "@type": "WebSite", "name": "The Medical Device Cybersecurity Crosswalk", "alternateName": "MDC Crosswalk", "url": "https://mdccrosswalk.com/", "description": "Compare FDA, EU MDR, MHRA, PMDA, NMPA, TGA, MFDS and Health Canada medical device cybersecurity requirements across 29 jurisdictions." }, { "@context": "https://schema.org", "@type": "Organization", "name": "MDC Crosswalk", "url": "https://mdccrosswalk.com/", "logo": "https://mdccrosswalk.com/favicon.png", "sameAs": [ "https://bluegoatcyber.com" ], "description": "An editorial reference comparing global medical-device cybersecurity regulations. Maintained by Blue Goat Cyber." }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://mdccrosswalk.lovable.app/" }, { "@type": "ListItem", "position": 2, "name": "Compare", "item": "https://mdccrosswalk.lovable.app/compare" } ] } ] ```