Question 1

Is IMDRF N60 a regulation I have to follow?

Accepted Answer

No, IMDRF guidance is non-binding. But the FDA, Health Canada, PMDA, TGA, MFDS, HSA and SFDA all explicitly align to it. Treating N60 as your design baseline is the cheapest path to multi-market readiness.

Question 2

Which frameworks should I build to first?

Accepted Answer

IEC 81001-5-1 (process), IEC 62443-4-1 (parent), AAMI TIR57 (risk), and ISO 14971 (safety risk integration). If you can demonstrate maturity against these four, every regulator on the crosswalk will accept your evidence with minimal rework.

Question 3

What's the difference between SPDF and SDLC?

Accepted Answer

SPDF (FDA's Secure Product Development Framework) is medical-device-specific and covers governance, design, implementation and post-market activities together. SDLC is the generic term. The FDA's SPDF is essentially a tailored SDLC plus lifecycle commitments.

Question 4

What is a 'cyber device' under FD&C Section 524B?

Accepted Answer

A device that (1) includes software validated, installed or authorised by the sponsor, (2) has the ability to connect to the internet, and (3) contains technological characteristics that could be vulnerable to cybersecurity threats. If your device meets all three, Section 524B applies, and your 510(k), De Novo or PMA must include cybersecurity content.

Question 5

Do I need cybersecurity controls if my device only connects via Bluetooth?

Accepted Answer

Yes. 'Connected' under FDA, MDCG and IMDRF includes Bluetooth, Wi-Fi, NFC, USB, and any other electronic interface. The attack surface, not the protocol, drives scope.

Question 6

Can I reuse my FDA cybersecurity package in other markets?

Accepted Answer

Largely yes. Health Canada (~95% reusable), Singapore HSA (~90%), TGA (~85%), SFDA (~85%), MHRA (~80%). The EU and Switzerland require the most reformatting due to GSPR and Notified Body expectations. China is the biggest reformat (~45%) due to MLPS and PIPL overlay.

Question 7

Do I really need an SBOM for every market?

Accepted Answer

Not strictly, only the FDA and PMDA mandate it explicitly today. But the EU CRA (from 2027) will require one, Notified Bodies under MDR are already asking, and Health Canada now expects it for Class III/IV. Generate it once in CycloneDX or SPDX and distribute everywhere.

Question 8

What does FDA mean by 'architecture views'?

Accepted Answer

Four diagrams: global system view, multi-patient harm view, updateability/patchability view, and security use case views. Reviewers compare these against your threat model and test evidence, if they don't reconcile, you'll get a deficiency letter.

Question 9

How deep does penetration testing need to go?

Accepted Answer

FDA expects independent testing covering the full attack surface, host, network, wireless, web/cloud APIs, and ancillary software. Methodology should reference NIST SP 800-115 or equivalent, and the report must include scope, methodology, findings with severity, and remediation status.

Question 10

Is threat modelling actually required, or just recommended?

Accepted Answer

Required by FDA (eSTAR Section 14), expected by Notified Bodies under MDCG 2019-16, and explicitly called out in PMDA, MFDS and HSA guidance. STRIDE is the most commonly accepted methodology. The model must be living, updated with every architectural change.

Question 11

How does the EU Cyber Resilience Act change things?

Accepted Answer

CRA's reporting obligations start 11 September 2026 and full compliance lands 11 December 2027. Manufacturers must send an early warning to ENISA within 24 hours of becoming aware of an actively exploited vulnerability or severe incident, and a full notification within 72 hours. Expect overlap with MDCG 2019-16 and mandatory SBOMs in machine-readable form. (Scope note: MDR/IVDR-covered devices are carved out of CRA under Art. 2, but the Commission's harmonised approach is to treat CRA's clocks and SBOM expectations as the practical floor for connected devices.)

Question 12

What is China's MLPS 2.0 and does it apply to my device?

Accepted Answer

MLPS 2.0 (Multi-Level Protection Scheme) is China's cybersecurity classification system, ranking systems Level 1–5. Most connected medical devices land at Level 2 or 3, requiring annual third-party assessment by an MPS-approved lab. PIPL (personal information) and DSL (data security) sit on top.

Question 13

Do I need a CH-REP for Switzerland after MRA suspension?

Accepted Answer

Yes. Since the EU–CH MRA lapsed in May 2021, Swissmedic requires a Swiss Authorised Representative (CH-REP) for every device placed on the Swiss market. The CH-REP holds technical documentation including your cybersecurity file.

Question 14

What about AI/ML medical devices?

Accepted Answer

MFDS AI/ML addendum (2023), the FDA's Predetermined Change Control Plan (PCCP), and the EU AI Act all add a layer on top of cybersecurity. Threat modelling must cover model integrity, training-data poisoning, prompt injection (for LLM-backed devices), and adversarial inputs.

Question 15

How does the UK's MHRA approach differ from EU MDR post-Brexit?

Accepted Answer

MHRA still recognises CE marks until June 2030 and broadly aligns with MDCG 2019-16, but it's developing its own UKCA framework. Expect divergence on post-market reporting timelines and the future Software as a Medical Device (SaMD) regime.

Question 16

Do I need a separate CVD program per region?

Accepted Answer

One global Coordinated Vulnerability Disclosure program suffices, but you must publish region-specific contact points and adapt the timelines: China 24h, EU CRA 24h early-warning + 72h full notification (from 11 Sep 2026), US FDA 30 days for serious incidents. The MDR's 15-day vigilance clock still applies for general safety incidents - it is not the cyber clock. H-ISAC membership signals maturity to every regulator.

Question 17

What's the realistic timeline to get cybersecurity-ready for a first FDA submission?

Accepted Answer

For a Class II connected device starting from zero: 12–16 weeks. That includes threat modelling, SBOM generation, security risk assessment per AAMI TIR57, penetration testing, SPDF documentation, and eSTAR Section 14 assembly. Starting earlier in design saves multiples of that downstream.

Question 18

How often do I need to refresh my SBOM and threat model?

Accepted Answer

SBOM: at every release, plus on any third-party component change. Threat model: at every architectural change, and reviewed annually at minimum. Both must be retained as part of the device master record and provided on regulator request.

Question 19

What triggers a postmarket cybersecurity report to FDA?

Accepted Answer

An uncontrolled risk to safety or essential performance, not every CVE. The FDA's 2016 postmarket guidance defines 'controlled' vs 'uncontrolled' risk; uncontrolled risks require a 30-day report under 21 CFR 806. Routine patches with documented compensating controls do not.

The questions every MedTech team asks twice.

01 · Foundations

02 · Submissions & evidence

03 · Region-specific

04 · Operations & post-market