--- title: "Medical Device Cybersecurity FAQ: FDA, EU MDR, PMDA & more" description: "Answers to 20+ questions every MedTech RA/QA team asks about §524B, MDCG 2019-16, SBOM, threat modeling, CVD, EU CRA, MLPS 2.0 and CH-REPs." lang: en json-ld: | [ { "@context": "https://schema.org", "@type": "WebSite", "name": "The Medical Device Cybersecurity Crosswalk", "alternateName": "MDC Crosswalk", "url": "https://mdccrosswalk.com/", "description": "Compare FDA, EU MDR, MHRA, PMDA, NMPA, TGA, MFDS and Health Canada medical device cybersecurity requirements across 29 jurisdictions." }, { "@context": "https://schema.org", "@type": "Organization", "name": "MDC Crosswalk", "url": "https://mdccrosswalk.com/", "logo": "https://mdccrosswalk.com/favicon.png", "sameAs": [ "https://bluegoatcyber.com" ], "description": "An editorial reference comparing global medical-device cybersecurity regulations. Maintained by Blue Goat Cyber." }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Is IMDRF N60 a regulation I have to follow?", "acceptedAnswer": { "@type": "Answer", "text": "No, IMDRF guidance is non-binding. But the FDA, Health Canada, PMDA, TGA, MFDS, HSA and SFDA all explicitly align to it. Treating N60 as your design baseline is the cheapest path to multi-market readiness." } }, { "@type": "Question", "name": "Which frameworks should I build to first?", "acceptedAnswer": { "@type": "Answer", "text": "IEC 81001-5-1 (process), IEC 62443-4-1 (parent), AAMI TIR57 (risk), and ISO 14971 (safety risk integration). If you can demonstrate maturity against these four, every regulator on the crosswalk will accept your evidence with minimal rework." } }, { "@type": "Question", "name": "What's the difference between SPDF and SDLC?", "acceptedAnswer": { "@type": "Answer", "text": "SPDF (FDA's Secure Product Development Framework) is medical-device-specific and covers governance, design, implementation and post-market activities together. SDLC is the generic term. The FDA's SPDF is essentially a tailored SDLC plus lifecycle commitments." } }, { "@type": "Question", "name": "What is a 'cyber device' under FD&C Section 524B?", "acceptedAnswer": { "@type": "Answer", "text": "A device that (1) includes software validated, installed or authorised by the sponsor, (2) has the ability to connect to the internet, and (3) contains technological characteristics that could be vulnerable to cybersecurity threats. If your device meets all three, Section 524B applies, and your 510(k), De Novo or PMA must include cybersecurity content." } }, { "@type": "Question", "name": "Do I need cybersecurity controls if my device only connects via Bluetooth?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. 'Connected' under FDA, MDCG and IMDRF includes Bluetooth, Wi-Fi, NFC, USB, and any other electronic interface. The attack surface, not the protocol, drives scope." } }, { "@type": "Question", "name": "Can I reuse my FDA cybersecurity package in other markets?", "acceptedAnswer": { "@type": "Answer", "text": "Largely yes. Health Canada (~95% reusable), Singapore HSA (~90%), TGA (~85%), SFDA (~85%), MHRA (~80%). The EU and Switzerland require the most reformatting due to GSPR and Notified Body expectations. China is the biggest reformat (~45%) due to MLPS and PIPL overlay." } }, { "@type": "Question", "name": "Do I really need an SBOM for every market?", "acceptedAnswer": { "@type": "Answer", "text": "Not strictly, only the FDA and PMDA mandate it explicitly today. But the EU CRA (from 2027) will require one, Notified Bodies under MDR are already asking, and Health Canada now expects it for Class III/IV. Generate it once in CycloneDX or SPDX and distribute everywhere." } }, { "@type": "Question", "name": "What does FDA mean by 'architecture views'?", "acceptedAnswer": { "@type": "Answer", "text": "Four diagrams: global system view, multi-patient harm view, updateability/patchability view, and security use case views. Reviewers compare these against your threat model and test evidence, if they don't reconcile, you'll get a deficiency letter." } }, { "@type": "Question", "name": "How deep does penetration testing need to go?", "acceptedAnswer": { "@type": "Answer", "text": "FDA expects independent testing covering the full attack surface, host, network, wireless, web/cloud APIs, and ancillary software. Methodology should reference NIST SP 800-115 or equivalent, and the report must include scope, methodology, findings with severity, and remediation status." } }, { "@type": "Question", "name": "Is threat modelling actually required, or just recommended?", "acceptedAnswer": { "@type": "Answer", "text": "Required by FDA (eSTAR Section 14), expected by Notified Bodies under MDCG 2019-16, and explicitly called out in PMDA, MFDS and HSA guidance. STRIDE is the most commonly accepted methodology. The model must be living, updated with every architectural change." } }, { "@type": "Question", "name": "How does the EU Cyber Resilience Act change things?", "acceptedAnswer": { "@type": "Answer", "text": "CRA's reporting obligations start 11 September 2026 and full compliance lands 11 December 2027. Manufacturers must send an early warning to ENISA within 24 hours of becoming aware of an actively exploited vulnerability or severe incident, and a full notification within 72 hours. Expect overlap with MDCG 2019-16 and mandatory SBOMs in machine-readable form. (Scope note: MDR/IVDR-covered devices are carved out of CRA under Art. 2, but the Commission's harmonised approach is to treat CRA's clocks and SBOM expectations as the practical floor for connected devices.)" } }, { "@type": "Question", "name": "What is China's MLPS 2.0 and does it apply to my device?", "acceptedAnswer": { "@type": "Answer", "text": "MLPS 2.0 (Multi-Level Protection Scheme) is China's cybersecurity classification system, ranking systems Level 1–5. Most connected medical devices land at Level 2 or 3, requiring annual third-party assessment by an MPS-approved lab. PIPL (personal information) and DSL (data security) sit on top." } }, { "@type": "Question", "name": "Do I need a CH-REP for Switzerland after MRA suspension?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Since the EU–CH MRA lapsed in May 2021, Swissmedic requires a Swiss Authorised Representative (CH-REP) for every device placed on the Swiss market. The CH-REP holds technical documentation including your cybersecurity file." } }, { "@type": "Question", "name": "What about AI/ML medical devices?", "acceptedAnswer": { "@type": "Answer", "text": "MFDS AI/ML addendum (2023), the FDA's Predetermined Change Control Plan (PCCP), and the EU AI Act all add a layer on top of cybersecurity. Threat modelling must cover model integrity, training-data poisoning, prompt injection (for LLM-backed devices), and adversarial inputs." } }, { "@type": "Question", "name": "How does the UK's MHRA approach differ from EU MDR post-Brexit?", "acceptedAnswer": { "@type": "Answer", "text": "MHRA still recognises CE marks until June 2030 and broadly aligns with MDCG 2019-16, but it's developing its own UKCA framework. Expect divergence on post-market reporting timelines and the future Software as a Medical Device (SaMD) regime." } }, { "@type": "Question", "name": "Do I need a separate CVD program per region?", "acceptedAnswer": { "@type": "Answer", "text": "One global Coordinated Vulnerability Disclosure program suffices, but you must publish region-specific contact points and adapt the timelines: China 24h, EU CRA 24h early-warning + 72h full notification (from 11 Sep 2026), US FDA 30 days for serious incidents. The MDR's 15-day vigilance clock still applies for general safety incidents - it is not the cyber clock. H-ISAC membership signals maturity to every regulator." } }, { "@type": "Question", "name": "What's the realistic timeline to get cybersecurity-ready for a first FDA submission?", "acceptedAnswer": { "@type": "Answer", "text": "For a Class II connected device starting from zero: 12–16 weeks. That includes threat modelling, SBOM generation, security risk assessment per AAMI TIR57, penetration testing, SPDF documentation, and eSTAR Section 14 assembly. Starting earlier in design saves multiples of that downstream." } }, { "@type": "Question", "name": "How often do I need to refresh my SBOM and threat model?", "acceptedAnswer": { "@type": "Answer", "text": "SBOM: at every release, plus on any third-party component change. Threat model: at every architectural change, and reviewed annually at minimum. Both must be retained as part of the device master record and provided on regulator request." } }, { "@type": "Question", "name": "What triggers a postmarket cybersecurity report to FDA?", "acceptedAnswer": { "@type": "Answer", "text": "An uncontrolled risk to safety or essential performance, not every CVE. The FDA's 2016 postmarket guidance defines 'controlled' vs 'uncontrolled' risk; uncontrolled risks require a 30-day report under 21 CFR 806. Routine patches with documented compensating controls do not." } } ] }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://mdccrosswalk.lovable.app/" }, { "@type": "ListItem", "position": 2, "name": "FAQ", "item": "https://mdccrosswalk.lovable.app/faq" } ] } ] --- [ The Crosswalk ](/) [Overview](/)[Playbook](/playbook)CompareReference [New Per-page social previews and this changelog ](/changelog "Per-page social previews and this changelog") Search⌘K 1. [Home ](/) 2. FAQ FAQ # The questions every MedTech team asks twice. Field-tested answers from 250+ submissions. Not legal advice, always validate against current regulator publications. Last updated · July 25, 2026 ## 01 · Foundations 5 questions ### Is IMDRF N60 a regulation I have to follow? ### Which frameworks should I build to first? ### What's the difference between SPDF and SDLC? ### What is a 'cyber device' under FD&C Section 524B? ### Do I need cybersecurity controls if my device only connects via Bluetooth? ## 02 · Submissions & evidence 5 questions ### Can I reuse my FDA cybersecurity package in other markets? ### Do I really need an SBOM for every market? ### What does FDA mean by 'architecture views'? ### How deep does penetration testing need to go? ### Is threat modelling actually required, or just recommended? ## 03 · Region-specific 5 questions ### How does the EU Cyber Resilience Act change things? ### What is China's MLPS 2.0 and does it apply to my device? ### Do I need a CH-REP for Switzerland after MRA suspension? ### What about AI/ML medical devices? ### How does the UK's MHRA approach differ from EU MDR post-Brexit? ## 04 · Operations & post-market 4 questions ### Do I need a separate CVD program per region? ### What's the realistic timeline to get cybersecurity-ready for a first FDA submission? ### How often do I need to refresh my SBOM and threat model? ### What triggers a postmarket cybersecurity report to FDA? Sponsored note · Blue Goat Cyber Still have questions? That's literally what we do all day. Bring your specific device, target markets and timeline. We'll tell you exactly which of these requirements apply, what evidence you already have, and what's missing, in 30 minutes. [Book a 30-min strategy session](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session) The Crosswalk An independent reference for global medical device cybersecurity standards. A field guide for MedTech innovators and RA/QA teams charting an international path. Resource - [Comparison matrix](/compare) - [Global playbook](/playbook) - [Glossary](/glossary) - [FAQ](/faq) Sponsored by [Blue Goat Cyber ↗](https://bluegoatcyber.com) Editorially independent. Sponsorship keeps it free. © 2026 The Crosswalk. Not legal advice. Validate every requirement against current regulator publications.