FDA Postmarket Cybersecurity

FDA's postmarket cybersecurity expectations treat a fielded device as a system whose risk profile changes continuously. A component that was clean at submission acquires a critical CVE eighteen months later; a hospital network changes in ways your threat model never anticipated; a researcher finds a flaw in your Bluetooth pairing implementation. The manufacturer is responsible for detecting these changes, assessing whether patient safety is affected, and acting within a defined timeframe.

That means a live process, not a document. You need continuous monitoring of the components in your SBOM against vulnerability feeds, a triage path that distinguishes exploitable-in-context from theoretically-vulnerable, and a decision framework for when a vulnerability constitutes an uncontrolled risk requiring notification.

Every manufacturer of a connected device should have a published disclosure policy, a monitored security contact, and a defined response window. Researchers who cannot find a way to report a flaw responsibly will eventually report it publicly, and the difference between a coordinated advisory and a surprise conference talk is entirely determined by whether you made reporting easy.

A functioning program includes acknowledgement timelines, a triage owner, a path to coordinate with CISA and the Health-ISAC where appropriate, and a template advisory. It also includes internal muscle memory: the engineering team needs to know how a security report becomes a CAPA, a patch, and a customer communication.

Patching a medical device is not patching a laptop. Updates may require validation, regression testing against clinical workflows, hospital change control, and in some cases a regulatory assessment of whether the change affects safety or effectiveness. Devices designed without a secure update mechanism are the hardest problem in the industry - the population is large, the remaining service life is long, and the mitigation is often compensating controls and clear customer guidance rather than a fix.

Deciding when a vulnerability triggers a field safety notice or a recall is a judgement call made against patient harm, exploitability, and available compensating controls. The conversations in these episodes cover how teams make that call, and what happens when they get it wrong.