--- title: "Medical Device Cybersecurity Glossary: SPDF, SBOM, MLPS & more" description: "Plain-English definitions for 30+ medical-device cybersecurity acronyms: SPDF, SBOM, CVD, MLPS 2.0, CH-REP, MDCG 2019-16, IMDRF N60 and more." lang: en json-ld: | [ { "@context": "https://schema.org", "@type": "WebSite", "name": "The Medical Device Cybersecurity Crosswalk", "alternateName": "MDC Crosswalk", "url": "https://mdccrosswalk.com/", "description": "Compare FDA, EU MDR, MHRA, PMDA, NMPA, TGA, MFDS and Health Canada medical device cybersecurity requirements across 29 jurisdictions." }, { "@context": "https://schema.org", "@type": "Organization", "name": "MDC Crosswalk", "url": "https://mdccrosswalk.com/", "logo": "https://mdccrosswalk.com/favicon.png", "sameAs": [ "https://bluegoatcyber.com" ], "description": "An editorial reference comparing global medical-device cybersecurity regulations. Maintained by Blue Goat Cyber." }, { "@context": "https://schema.org", "@type": "DefinedTermSet", "name": "Medical Device Cybersecurity Glossary", "hasDefinedTerm": [ { "@type": "DefinedTerm", "name": "SBOM", "description": "Inventory of every software component in a device, including version, supplier and known vulnerabilities. SPDX and CycloneDX are the dominant machine-readable formats." }, { "@type": "DefinedTerm", "name": "VEX", "description": "Companion document to an SBOM that states whether a known CVE actually affects the product (e.g. 'not_affected', 'fixed'), so operators don't chase irrelevant vulnerabilities." }, { "@type": "DefinedTerm", "name": "KEV", "description": "CISA-maintained list of CVEs with confirmed in-the-wild exploitation. Increasingly referenced by FDA and ENISA as priority patch targets." }, { "@type": "DefinedTerm", "name": "PSIRT", "description": "Manufacturer team responsible for receiving, triaging and disclosing security vulnerabilities under a CVD program (ISO/IEC 30111, FIRST PSIRT framework)." }, { "@type": "DefinedTerm", "name": "CVSS", "description": "FIRST.org severity scoring (0-10). Medical device guidance increasingly asks for CVSS plus a clinical/patient-harm modifier (e.g. AAMI TIR57 or the Rubric for Applying CVSS to Medical Devices)." }, { "@type": "DefinedTerm", "name": "CWE", "description": "MITRE taxonomy of software weakness types. Threat models and root-cause analyses commonly map findings to CWE IDs." }, { "@type": "DefinedTerm", "name": "SDLC / SSDLC", "description": "End-to-end process for building software with security activities at each stage. FDA's SPDF and IEC 81001-5-1 are concrete SSDLC frameworks for medical devices." }, { "@type": "DefinedTerm", "name": "SPDF", "description": "FDA-named umbrella for the activities a manufacturer performs to design, build and maintain secure devices." }, { "@type": "DefinedTerm", "name": "QMSR", "description": "FDA's 2024 amendment aligning Part 820 with ISO 13485:2016. Effective Feb 2 2026. The Feb 3 2026 FDA premarket cybersecurity guidance now positions SPDF as one way to satisfy the QMSR." }, { "@type": "DefinedTerm", "name": "PCCP", "description": "FDA mechanism (also mirrored by MHRA and MFDS) that lets a manufacturer pre-authorise defined post-market modifications - including AI/ML updates and certain cybersecurity changes - without a new submission." }, { "@type": "DefinedTerm", "name": "CVD", "description": "A documented process for receiving, validating and responding to security reports from researchers and users." }, { "@type": "DefinedTerm", "name": "IMDRF N60", "description": "International Medical Device Regulators Forum guidance harmonising cybersecurity expectations across jurisdictions. Referenced by FDA, Health Canada, TGA, MFDS, HSA, ANVISA and others." }, { "@type": "DefinedTerm", "name": "AAMI TIR57", "description": "Technical Information Report describing how to apply ISO 14971 risk management to cybersecurity. FDA and Health Canada cite it as state of the art." }, { "@type": "DefinedTerm", "name": "ISO/IEC 81001-5-1", "description": "International standard for secure development of health software. Harmonised under EU MDR and adopted/recognised by HSA, MFDS, TGA, Health Canada, MHRA and others." }, { "@type": "DefinedTerm", "name": "IEC 62443-4-1", "description": "IEC standard from the industrial automation series, frequently cited alongside 81001-5-1 for the SSDLC component of medical device cybersecurity." }, { "@type": "DefinedTerm", "name": "ISO 14971", "description": "Foundational risk management standard. Cybersecurity risk must be integrated into the same risk file (see AAMI TIR57 and ISO/IEC 81001-5-1)." }, { "@type": "DefinedTerm", "name": "IEC 62304", "description": "Software life-cycle standard required for any medical device containing software. Sets the baseline that 81001-5-1 layers security activities onto." }, { "@type": "DefinedTerm", "name": "MDSAP", "description": "One QMS audit accepted by Australia, Brazil, Canada, Japan and the US. Streamlines the QMS evidence portion of cybersecurity assessments." }, { "@type": "DefinedTerm", "name": "TPLC", "description": "Holistic regulatory philosophy that treats pre-market and post-market activities as a continuum." }, { "@type": "DefinedTerm", "name": "FSCA", "description": "Manufacturer-initiated action to reduce risk in already-marketed devices, including security patches." }, { "@type": "DefinedTerm", "name": "ISAO / ISAC", "description": "Trusted communities for sharing threat intel. H-ISAC is the dominant healthcare ISAC globally." }, { "@type": "DefinedTerm", "name": "UDI", "description": "Standardised device identifier required by FDA, EU MDR and others. SBOMs often reference UDIs." }, { "@type": "DefinedTerm", "name": "RTA", "description": "FDA action when a submission is missing required cybersecurity content under §524B." }, { "@type": "DefinedTerm", "name": "§524B", "description": "Statutory cybersecurity requirements added by the Consolidated Appropriations Act 2023. Applies to 'cyber devices' and is enforced through RTA." }, { "@type": "DefinedTerm", "name": "GSPR", "description": "Annex I of the EU MDR. GSPR 17.2 contains the cybersecurity-specific requirements." }, { "@type": "DefinedTerm", "name": "MDCG", "description": "EU-level body that publishes guidance on how to apply MDR in practice. MDCG 2019-16 is the cybersecurity guidance." }, { "@type": "DefinedTerm", "name": "NIS2", "description": "EU directive obliging essential and important entities (including medical device manufacturers in scope) to manage cyber risk and report incidents." }, { "@type": "DefinedTerm", "name": "CRA", "description": "EU horizontal cybersecurity regulation for products with digital elements. Reporting obligations under Art. 14 (24-hour early warning + 72-hour full notification for actively-exploited vulnerabilities and severe incidents) apply from Sep 11 2026; the remaining essential requirements apply from Dec 11 2027. MDR/IVDR devices are excluded from CRA's scope but are increasingly held to the same substantive floor." }, { "@type": "DefinedTerm", "name": "MDR (EU)", "description": "The EU regulation governing medical devices since May 2021. Cybersecurity expectations sit in Annex I GSPR 17.2 and are operationalised via MDCG 2019-16 Rev.1." }, { "@type": "DefinedTerm", "name": "IVDR", "description": "Companion regulation to MDR for IVDs. Mirrors MDR's cybersecurity expectations for software and connected IVDs." }, { "@type": "DefinedTerm", "name": "PSUR", "description": "EU MDR requirement; cybersecurity incidents and trends should be reflected." }, { "@type": "DefinedTerm", "name": "EUDAMED", "description": "EU-wide database for device, certificate, vigilance and market surveillance data under MDR/IVDR." }, { "@type": "DefinedTerm", "name": "DTAC", "description": "NHS England framework assessing clinical safety, data protection, technical assurance and interoperability." }, { "@type": "DefinedTerm", "name": "DSPT", "description": "Annual self-assessment NHS suppliers complete to demonstrate compliance with the National Data Guardian's standards." }, { "@type": "DefinedTerm", "name": "MHRA", "description": "UK competent authority for medical devices. Operates the UKCA route alongside continued recognition of CE marking." }, { "@type": "DefinedTerm", "name": "UKRP", "description": "Mandatory in-UK representative for non-UK medical-device manufacturers. Holds the technical documentation including cybersecurity evidence." }, { "@type": "DefinedTerm", "name": "CH-REP", "description": "Mandatory in-Switzerland representative since the EU-CH MRA lapsed." }, { "@type": "DefinedTerm", "name": "Swissmedic", "description": "Swiss agency for therapeutic products. Recognises EU MDR conformity but enforces Swiss-specific representation and labelling." }, { "@type": "DefinedTerm", "name": "DMP / Helsedirektoratet", "description": "Norway implements EU MDR via EEA. DMP (formerly Legemiddelverket) and Helsedirektoratet handle device oversight; Helsetilsynet oversees clinical use." }, { "@type": "DefinedTerm", "name": "PMDA", "description": "Japan's review agency. Issues cybersecurity guidance and operates the STED-based dossier review." }, { "@type": "DefinedTerm", "name": "STED", "description": "Common dossier format used by PMDA and several other regulators." }, { "@type": "DefinedTerm", "name": "PMD Act", "description": "Japan's primary law governing devices (formerly PAL). Cybersecurity expectations are layered via PMDA notifications." }, { "@type": "DefinedTerm", "name": "NMPA", "description": "China's device regulator. Issues the Technical Review Guideline for Cybersecurity of Medical Devices." }, { "@type": "DefinedTerm", "name": "MLPS", "description": "China's tiered cybersecurity grading framework. Most connected medical devices fall in Level 2 or 3 and must complete a registration with public security organs." }, { "@type": "DefinedTerm", "name": "PIPL", "description": "China's GDPR-equivalent. Restricts cross-border transfers of personal information including patient data." }, { "@type": "DefinedTerm", "name": "DSL", "description": "China's law classifying data by importance and imposing security and cross-border controls. Applies alongside PIPL and the Cybersecurity Law." }, { "@type": "DefinedTerm", "name": "CSL", "description": "2017 foundational cyber law. Establishes MLPS, critical information infrastructure protection and data localisation duties." }, { "@type": "DefinedTerm", "name": "TGA", "description": "Australia's regulator. Publishes the Medical device cyber security guidance for industry." }, { "@type": "DefinedTerm", "name": "MFDS", "description": "Korea's device regulator. Issues medical device cybersecurity review guidelines harmonised with IMDRF N60." }, { "@type": "DefinedTerm", "name": "DMPA", "description": "Korea's dedicated law for digital medical products, in force Jan 24 2025. Creates a separate track (with an accelerated review lane) for AI/ML-enabled SaMD, wearable, and cloud-based devices; enforcement decree and MFDS notifications continue to build out cyber and change-control detail through 2026." }, { "@type": "DefinedTerm", "name": "K-GMP", "description": "MFDS QMS scheme; cybersecurity evidence integrates with K-GMP audits." }, { "@type": "DefinedTerm", "name": "HSA", "description": "Singapore's device regulator. Publishes the Regulatory Guidelines for Software Medical Devices including cybersecurity." }, { "@type": "DefinedTerm", "name": "CSA", "description": "Operates the Cybersecurity Act and CII regime that may apply to healthcare providers using the device." }, { "@type": "DefinedTerm", "name": "ANVISA", "description": "Brazil's regulator. RDC 751/2022 and RDC 657/2022 carry the device and software/cyber expectations." }, { "@type": "DefinedTerm", "name": "SFDA", "description": "Saudi regulator. Publishes MDS-G42, the medical device cybersecurity guidance, plus MDS-REQ1 for general requirements." }, { "@type": "DefinedTerm", "name": "GHC", "description": "Regional GCC pathway that allows one dossier to be filed for KW, SA, AE, BH, OM and QA. Per-country acceptance still applies." }, { "@type": "DefinedTerm", "name": "CDSCO", "description": "India's national medical device regulator under the Medical Devices Rules 2017 (and 2024 amendments)." }, { "@type": "DefinedTerm", "name": "CERT-In", "description": "National CERT. The 2022 Directions impose 6-hour incident reporting and log retention duties that affect connected devices and SaMD operators in India." }, { "@type": "DefinedTerm", "name": "DPDP Act", "description": "India's data protection law. Applies to processing of patient data by device manufacturers and operators." }, { "@type": "DefinedTerm", "name": "AMAR", "description": "Israel's medical device registrar. Cybersecurity expectations follow the MoH Director-General circular on connected medical devices." }, { "@type": "DefinedTerm", "name": "INCD", "description": "Sets national cyber doctrine. Publishes the Healthcare Cybersecurity Methodology applied to hospitals and connected devices." }, { "@type": "DefinedTerm", "name": "TFDA", "description": "Taiwan's device regulator. Issues the Guidance for Industry on Management of Cybersecurity in Medical Devices, modelled on FDA/IMDRF." }, { "@type": "DefinedTerm", "name": "COFEPRIS", "description": "Mexico's health risk regulator. Recognises FDA, Health Canada and MHLW dossiers via the equivalence pathway (Acuerdo de Equivalencia)." }, { "@type": "DefinedTerm", "name": "MOHAP", "description": "Federal UAE health authority that registers medical devices outside Abu Dhabi and Dubai." }, { "@type": "DefinedTerm", "name": "DoH (Abu Dhabi)", "description": "Abu Dhabi health regulator. Operates ADHICS, the emirate-wide healthcare information security standard." }, { "@type": "DefinedTerm", "name": "ADHICS", "description": "Mandatory cyber/info-security control set for healthcare entities in Abu Dhabi; flows down to connected device suppliers." }, { "@type": "DefinedTerm", "name": "DHA", "description": "Dubai's regulator. Operates the Information Security Regulation (ISR) for health entities in Dubai." }, { "@type": "DefinedTerm", "name": "SAHPRA", "description": "South Africa's medical device regulator under the Medicines and Related Substances Act." }, { "@type": "DefinedTerm", "name": "POPIA", "description": "South Africa's data protection law. Applies to patient data processed by devices and SaMD." }, { "@type": "DefinedTerm", "name": "MDA (Malaysia)", "description": "Malaysia's device regulator under the Medical Device Act 2012. Note: distinct from the EU MDR's references." }, { "@type": "DefinedTerm", "name": "Thai FDA / MoPH", "description": "Thailand's device regulator. Cybersecurity expectations align with ASEAN Medical Device Directive and IMDRF." }, { "@type": "DefinedTerm", "name": "Kemenkes", "description": "Indonesia's device registrar via InfoAlkes." }, { "@type": "DefinedTerm", "name": "BSSN", "description": "Indonesia's National Cyber and Crypto Agency. Sets cyber-resilience expectations that apply to healthcare providers and connected devices." }, { "@type": "DefinedTerm", "name": "UU PDP", "description": "Indonesia's Personal Data Protection Law (Law 27/2022). Applies to patient data processing by device makers and operators." }, { "@type": "DefinedTerm", "name": "Komdigi", "description": "Indonesia's renamed Ministry of Communications and Digital Affairs (formerly Kominfo). Co-regulates UU PDP." }, { "@type": "DefinedTerm", "name": "Circular 30 (Vietnam)", "description": "Vietnam MoH circular setting medical device classification, registration and post-market duties - including reporting obligations relevant to cybersecurity incidents." }, { "@type": "DefinedTerm", "name": "FDA-PH", "description": "Philippine device regulator. Has issued draft Guidelines on the Regulation of Medical Device Software (MDSW)." }, { "@type": "DefinedTerm", "name": "DICT", "description": "Operates the National Cybersecurity Plan that contextualises healthcare cyber expectations." }, { "@type": "DefinedTerm", "name": "ANMAT", "description": "Argentina's regulator. Disposición 8054/2010 (and successors) governs medical devices; cybersecurity follows IMDRF N60 in practice." }, { "@type": "DefinedTerm", "name": "INVIMA", "description": "Colombia's regulator for medical devices and other health technologies." }, { "@type": "DefinedTerm", "name": "ISP", "description": "Chile's public health institute and device regulator." }, { "@type": "DefinedTerm", "name": "Ley 21.541", "description": "Chile's framework law on cybersecurity and critical information infrastructure (2024). Establishes ANCI and incident-reporting duties relevant to healthcare operators." }, { "@type": "DefinedTerm", "name": "TİTCK", "description": "Turkish Medicines and Medical Devices Agency. Mirrors EU MDR with national overlays." }, { "@type": "DefinedTerm", "name": "ÜTS", "description": "Turkey's product tracking system; mandatory device registration and traceability platform." }, { "@type": "DefinedTerm", "name": "KVKK", "description": "Turkey's Personal Data Protection Law (Law 6698). Applies to patient data processed by device makers and operators." }, { "@type": "DefinedTerm", "name": "Medsafe", "description": "New Zealand's medicines and medical devices safety authority within the Ministry of Health." }, { "@type": "DefinedTerm", "name": "WAND", "description": "NZ Medsafe's online device notification database - currently the primary regulatory entry point pending the new Therapeutic Products regime." } ] }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://mdccrosswalk.lovable.app/" }, { "@type": "ListItem", "position": 2, "name": "Glossary", "item": "https://mdccrosswalk.lovable.app/glossary" } ] } ] --- [ The Crosswalk ](/) [Overview](/)[Playbook](/playbook)CompareReference [New Per-page social previews and this changelog ](/changelog "Per-page social previews and this changelog") Search⌘K 1. [Home ](/) 2. Glossary Glossary # The acronyms, decoded. 87 terms across 45 jurisdictions (38 covered + 7 emerging) and the cross-cutting standards. Linkable - share /glossary#SBOM. Last updated · July 25, 2026 §524B FD&C Act Section 524B US Statutory cybersecurity requirements added by the Consolidated Appropriations Act 2023. Applies to 'cyber devices' and is enforced through RTA. AAMI TIR57 Principles for Medical Device Security - Risk Management Technical Information Report describing how to apply ISO 14971 risk management to cybersecurity. FDA and Health Canada cite it as state of the art. ADHICS Abu Dhabi Healthcare Information and Cyber Security Standard AE Mandatory cyber/info-security control set for healthcare entities in Abu Dhabi; flows down to connected device suppliers. AMAR Medical Devices Division, Israeli MoH IL Israel's medical device registrar. Cybersecurity expectations follow the MoH Director-General circular on connected medical devices. ANMAT Administración Nacional de Medicamentos, Alimentos y Tecnología Médica AR Argentina's regulator. Disposición 8054/2010 (and successors) governs medical devices; cybersecurity follows IMDRF N60 in practice. ANVISA Agência Nacional de Vigilância Sanitária BR Brazil's regulator. RDC 751/2022 and RDC 657/2022 carry the device and software/cyber expectations. BSSN Badan Siber dan Sandi Negara ID Indonesia's National Cyber and Crypto Agency. Sets cyber-resilience expectations that apply to healthcare providers and connected devices. CDSCO Central Drugs Standard Control Organisation IN India's national medical device regulator under the Medical Devices Rules 2017 (and 2024 amendments). CERT-In Indian Computer Emergency Response Team IN National CERT. The 2022 Directions impose 6-hour incident reporting and log retention duties that affect connected devices and SaMD operators in India. CH-REP Swiss Authorised Representative CH Mandatory in-Switzerland representative since the EU-CH MRA lapsed. Circular 30 (Vietnam) VN Vietnam MoH circular setting medical device classification, registration and post-market duties - including reporting obligations relevant to cybersecurity incidents. COFEPRIS Comisión Federal para la Protección contra Riesgos Sanitarios MX Mexico's health risk regulator. Recognises FDA, Health Canada and MHLW dossiers via the equivalence pathway (Acuerdo de Equivalencia). CRA Cyber Resilience Act (Regulation (EU) 2024/2847) EU EU horizontal cybersecurity regulation for products with digital elements. Reporting obligations under Art. 14 (24-hour early warning + 72-hour full notification for actively-exploited vulnerabilities and severe incidents) apply from Sep 11 2026; the remaining essential requirements apply from Dec 11 2027. MDR/IVDR devices are excluded from CRA's scope but are increasingly held to the same substantive floor. CSA Cyber Security Agency of Singapore SG Operates the Cybersecurity Act and CII regime that may apply to healthcare providers using the device. CSL Cybersecurity Law (China) CN 2017 foundational cyber law. Establishes MLPS, critical information infrastructure protection and data localisation duties. CVD Coordinated Vulnerability Disclosure A documented process for receiving, validating and responding to security reports from researchers and users. CVSS Common Vulnerability Scoring System FIRST.org severity scoring (0-10). Medical device guidance increasingly asks for CVSS plus a clinical/patient-harm modifier (e.g. AAMI TIR57 or the Rubric for Applying CVSS to Medical Devices). CWE Common Weakness Enumeration MITRE taxonomy of software weakness types. Threat models and root-cause analyses commonly map findings to CWE IDs. DHA Dubai Health Authority AE Dubai's regulator. Operates the Information Security Regulation (ISR) for health entities in Dubai. DICT Department of Information and Communications Technology (Philippines) PH Operates the National Cybersecurity Plan that contextualises healthcare cyber expectations. DMP / Helsedirektoratet Norwegian Medical Products Agency / Norwegian Directorate of Health NO Norway implements EU MDR via EEA. DMP (formerly Legemiddelverket) and Helsedirektoratet handle device oversight; Helsetilsynet oversees clinical use. DMPA Digital Medical Products Act KR Korea's dedicated law for digital medical products, in force Jan 24 2025. Creates a separate track (with an accelerated review lane) for AI/ML-enabled SaMD, wearable, and cloud-based devices; enforcement decree and MFDS notifications continue to build out cyber and change-control detail through 2026. DoH (Abu Dhabi) Department of Health - Abu Dhabi AE Abu Dhabi health regulator. Operates ADHICS, the emirate-wide healthcare information security standard. DPDP Act Digital Personal Data Protection Act 2023 IN India's data protection law. Applies to processing of patient data by device manufacturers and operators. DSL Data Security Law CN China's law classifying data by importance and imposing security and cross-border controls. Applies alongside PIPL and the Cybersecurity Law. DSPT Data Security and Protection Toolkit UK Annual self-assessment NHS suppliers complete to demonstrate compliance with the National Data Guardian's standards. DTAC Digital Technology Assessment Criteria UK NHS England framework assessing clinical safety, data protection, technical assurance and interoperability. EUDAMED European Database on Medical Devices EU EU-wide database for device, certificate, vigilance and market surveillance data under MDR/IVDR. FDA-PH Food and Drug Administration of the Philippines PH Philippine device regulator. Has issued draft Guidelines on the Regulation of Medical Device Software (MDSW). FSCA Field Safety Corrective Action Manufacturer-initiated action to reduce risk in already-marketed devices, including security patches. GHC Gulf Health Council Centralized Registration Procedure SA Regional GCC pathway that allows one dossier to be filed for KW, SA, AE, BH, OM and QA. Per-country acceptance still applies. GSPR General Safety and Performance Requirements EU Annex I of the EU MDR. GSPR 17.2 contains the cybersecurity-specific requirements. HSA Health Sciences Authority SG Singapore's device regulator. Publishes the Regulatory Guidelines for Software Medical Devices including cybersecurity. IEC 62304 Medical device software - Software life cycle processes Software life-cycle standard required for any medical device containing software. Sets the baseline that 81001-5-1 layers security activities onto. IEC 62443-4-1 Secure product development life-cycle requirements IEC standard from the industrial automation series, frequently cited alongside 81001-5-1 for the SSDLC component of medical device cybersecurity. IMDRF N60 Principles and Practices for Medical Device Cybersecurity International Medical Device Regulators Forum guidance harmonising cybersecurity expectations across jurisdictions. Referenced by FDA, Health Canada, TGA, MFDS, HSA, ANVISA and others. INCD Israel National Cyber Directorate IL Sets national cyber doctrine. Publishes the Healthcare Cybersecurity Methodology applied to hospitals and connected devices. INVIMA Instituto Nacional de Vigilancia de Medicamentos y Alimentos CO Colombia's regulator for medical devices and other health technologies. ISAO / ISAC Information Sharing & Analysis Organization / Center Trusted communities for sharing threat intel. H-ISAC is the dominant healthcare ISAC globally. ISO 14971 Application of risk management to medical devices Foundational risk management standard. Cybersecurity risk must be integrated into the same risk file (see AAMI TIR57 and ISO/IEC 81001-5-1). ISO/IEC 81001-5-1 Health software - Security activities in the product life cycle International standard for secure development of health software. Harmonised under EU MDR and adopted/recognised by HSA, MFDS, TGA, Health Canada, MHRA and others. ISP Instituto de Salud Pública de Chile CL Chile's public health institute and device regulator. IVDR In Vitro Diagnostic Regulation 2017/746 EU Companion regulation to MDR for IVDs. Mirrors MDR's cybersecurity expectations for software and connected IVDs. K-GMP Korean Good Manufacturing Practice KR MFDS QMS scheme; cybersecurity evidence integrates with K-GMP audits. Kemenkes Kementerian Kesehatan (Ministry of Health, Indonesia) ID Indonesia's device registrar via InfoAlkes. KEV Known Exploited Vulnerabilities (CISA catalog) CISA-maintained list of CVEs with confirmed in-the-wild exploitation. Increasingly referenced by FDA and ENISA as priority patch targets. Komdigi Kementerian Komunikasi dan Digital ID Indonesia's renamed Ministry of Communications and Digital Affairs (formerly Kominfo). Co-regulates UU PDP. KVKK Kişisel Verilerin Korunması Kanunu TR Turkey's Personal Data Protection Law (Law 6698). Applies to patient data processed by device makers and operators. Ley 21.541 CL Chile's framework law on cybersecurity and critical information infrastructure (2024). Establishes ANCI and incident-reporting duties relevant to healthcare operators. MDA (Malaysia) Medical Device Authority MY Malaysia's device regulator under the Medical Device Act 2012. Note: distinct from the EU MDR's references. MDCG Medical Device Coordination Group EU EU-level body that publishes guidance on how to apply MDR in practice. MDCG 2019-16 is the cybersecurity guidance. MDR (EU) Medical Device Regulation 2017/745 EU The EU regulation governing medical devices since May 2021. Cybersecurity expectations sit in Annex I GSPR 17.2 and are operationalised via MDCG 2019-16 Rev.1. MDSAP Medical Device Single Audit Program One QMS audit accepted by Australia, Brazil, Canada, Japan and the US. Streamlines the QMS evidence portion of cybersecurity assessments. Medsafe NZ New Zealand's medicines and medical devices safety authority within the Ministry of Health. MFDS Ministry of Food and Drug Safety KR Korea's device regulator. Issues medical device cybersecurity review guidelines harmonised with IMDRF N60. MHRA Medicines and Healthcare products Regulatory Agency UK UK competent authority for medical devices. Operates the UKCA route alongside continued recognition of CE marking. MLPS Multi-Level Protection Scheme CN China's tiered cybersecurity grading framework. Most connected medical devices fall in Level 2 or 3 and must complete a registration with public security organs. MOHAP Ministry of Health and Prevention (UAE federal) AE Federal UAE health authority that registers medical devices outside Abu Dhabi and Dubai. NIS2 Network and Information Security Directive 2 EU EU directive obliging essential and important entities (including medical device manufacturers in scope) to manage cyber risk and report incidents. NMPA National Medical Products Administration CN China's device regulator. Issues the Technical Review Guideline for Cybersecurity of Medical Devices. PCCP Predetermined Change Control Plan FDA mechanism (also mirrored by MHRA and MFDS) that lets a manufacturer pre-authorise defined post-market modifications - including AI/ML updates and certain cybersecurity changes - without a new submission. PIPL Personal Information Protection Law CN China's GDPR-equivalent. Restricts cross-border transfers of personal information including patient data. PMD Act Pharmaceuticals and Medical Devices Act JP Japan's primary law governing devices (formerly PAL). Cybersecurity expectations are layered via PMDA notifications. PMDA Pharmaceuticals and Medical Devices Agency JP Japan's review agency. Issues cybersecurity guidance and operates the STED-based dossier review. POPIA Protection of Personal Information Act ZA South Africa's data protection law. Applies to patient data processed by devices and SaMD. PSIRT Product Security Incident Response Team Manufacturer team responsible for receiving, triaging and disclosing security vulnerabilities under a CVD program (ISO/IEC 30111, FIRST PSIRT framework). PSUR Periodic Safety Update Report EU EU MDR requirement; cybersecurity incidents and trends should be reflected. QMSR Quality Management System Regulation (21 CFR Part 820) FDA's 2024 amendment aligning Part 820 with ISO 13485:2016. Effective Feb 2 2026. The Feb 3 2026 FDA premarket cybersecurity guidance now positions SPDF as one way to satisfy the QMSR. RTA Refusal to Accept US FDA action when a submission is missing required cybersecurity content under §524B. SAHPRA South African Health Products Regulatory Authority ZA South Africa's medical device regulator under the Medicines and Related Substances Act. SBOM Software Bill of Materials Inventory of every software component in a device, including version, supplier and known vulnerabilities. SPDX and CycloneDX are the dominant machine-readable formats. SDLC / SSDLC (Secure) Software Development Life Cycle End-to-end process for building software with security activities at each stage. FDA's SPDF and IEC 81001-5-1 are concrete SSDLC frameworks for medical devices. SFDA Saudi Food and Drug Authority SA Saudi regulator. Publishes MDS-G42, the medical device cybersecurity guidance, plus MDS-REQ1 for general requirements. SPDF Secure Product Development Framework FDA-named umbrella for the activities a manufacturer performs to design, build and maintain secure devices. STED Summary Technical Documentation Common dossier format used by PMDA and several other regulators. Swissmedic CH Swiss agency for therapeutic products. Recognises EU MDR conformity but enforces Swiss-specific representation and labelling. TFDA Taiwan Food and Drug Administration TW Taiwan's device regulator. Issues the Guidance for Industry on Management of Cybersecurity in Medical Devices, modelled on FDA/IMDRF. TGA Therapeutic Goods Administration AU Australia's regulator. Publishes the Medical device cyber security guidance for industry. Thai FDA / MoPH Thailand Food and Drug Administration / Ministry of Public Health TH Thailand's device regulator. Cybersecurity expectations align with ASEAN Medical Device Directive and IMDRF. TİTCK Türkiye İlaç ve Tıbbi Cihaz Kurumu TR Turkish Medicines and Medical Devices Agency. Mirrors EU MDR with national overlays. TPLC Total Product Life Cycle Holistic regulatory philosophy that treats pre-market and post-market activities as a continuum. UDI Unique Device Identifier Standardised device identifier required by FDA, EU MDR and others. SBOMs often reference UDIs. UKRP UK Responsible Person UK Mandatory in-UK representative for non-UK medical-device manufacturers. Holds the technical documentation including cybersecurity evidence. ÜTS Ürün Takip Sistemi TR Turkey's product tracking system; mandatory device registration and traceability platform. UU PDP Undang-Undang Pelindungan Data Pribadi ID Indonesia's Personal Data Protection Law (Law 27/2022). Applies to patient data processing by device makers and operators. VEX Vulnerability Exploitability eXchange Companion document to an SBOM that states whether a known CVE actually affects the product (e.g. 'not\_affected', 'fixed'), so operators don't chase irrelevant vulnerabilities. WAND Web-Assisted Notification of Devices NZ NZ Medsafe's online device notification database - currently the primary regulatory entry point pending the new Therapeutic Products regime. The Crosswalk An independent reference for global medical device cybersecurity standards. A field guide for MedTech innovators and RA/QA teams charting an international path. Resource - [Comparison matrix](/compare) - [Global playbook](/playbook) - [Glossary](/glossary) - [FAQ](/faq) Sponsored by [Blue Goat Cyber ↗](https://bluegoatcyber.com) Editorially independent. Sponsorship keeps it free. © 2026 The Crosswalk. Not legal advice. Validate every requirement against current regulator publications.