The Med Device Cyber Podcast
Medical-device security glossary
Cybersecurity language in the context of medical devices, FDA submissions and real interview discussions.
Based on FDA's February 3, 2026 guidance and section 524B. Plain-language summaries, not device-specific regulatory advice; interview perspectives are separate from official requirements.
10 terms
Compliance
Meeting the legal and regulatory requirements that apply to a particular device and submission. FDA guidance describes recommendations unless it cites a binding requirement; following a checklist or passing a security test does not by itself establish compliance or FDA authorization.
In medical devices: Separate section 524B obligations from guidance recommendations, and document which requirements apply to your device.
FDA guidance: nonbinding recommendations and section VIICoordinated vulnerability disclosure (CVD)
A process for receiving, assessing and coordinating reports of security weaknesses with researchers and affected parties so vulnerabilities can be addressed responsibly.
In medical devices: For covered cyber-device submissions, section 524B requires a postmarket vulnerability plan that includes coordinated vulnerability disclosure and related procedures.
FDA guidance: section VII.C.1
Joe SaundersCybersecurity
Protecting systems, software and information against unauthorized access, modification, disruption or misuse. For a medical device, cybersecurity also concerns how security failures could affect the device's safety and effectiveness.
In medical devices: Consider the full device system, including companion software, connections, users and supporting services—not only the device enclosure.
FDA guidance: sections IV–VPatching
Updating software to correct defects or security vulnerabilities. A patch is one risk-control measure, not a substitute for secure design, monitoring and a broader vulnerability-management process.
In medical devices: Section 524B distinguishes a reasonably justified regular cycle for known unacceptable vulnerabilities from out-of-cycle updates as soon as possible for critical vulnerabilities that could cause uncontrolled risks.
FDA guidance: section VII.C.2Penetration testing
An authorized security assessment that attempts to exploit weaknesses to understand realistic attack paths and their impact. It differs from a vulnerability scan, which primarily identifies potential weaknesses.
In medical devices: Define the tested system, scope and methods, relate findings to device risks, and document mitigations and retesting. A single test cannot prove that a device is secure.
FDA guidance: section V.CPremarket
The period and activities before a medical device is marketed. A premarket submission provides FDA with the evidence needed for the applicable review pathway; requirements vary by device and pathway.
In medical devices: Cybersecurity evidence should be developed alongside the device. Section 524B adds specific obligations for covered cyber-device submissions; it does not make all devices subject to the same pathway.
FDA medical-device cybersecurity FAQsRisk management
A continuing process of identifying, evaluating, controlling and monitoring risks. Security risk management considers threats and vulnerabilities, including their potential effects on device safety and effectiveness.
In medical devices: FDA treats security risk management as distinct from safety risk management. The two processes should inform each other rather than being treated as interchangeable.
FDA guidance: section V.ASoftware bill of materials (SBOM)
An inventory of the software components in a product and information such as their versions and dependencies. It helps teams identify affected components when vulnerabilities are reported; an inventory alone does not resolve those vulnerabilities.
In medical devices: Section 524B requires an SBOM including commercial, open-source and off-the-shelf components for covered cyber-device submissions. FDA also recommends component support information and vulnerability assessments.
FDA guidance: sections V.A.4(b) and VII.C.3
Liam DowdThreat modeling
A structured examination of a system's architecture, data flows, trust boundaries and possible attacks to identify threats and choose mitigations.
In medical devices: Start during design and update the model as the device and its environment change. Use it to guide security requirements and testing, not simply as a submission document.
FDA guidance: section V.A.1Vulnerability
A weakness in software, hardware, configuration or a process that a threat could exploit. The existence of a vulnerability is not the same as a confirmed attack, and its significance depends on the device and system context.
In medical devices: Assess exploitability, potential safety and security impact, and existing controls. Track both known component vulnerabilities and weaknesses found through device-specific testing.
FDA guidance: sections V.A and V.C