Compliance FrameworksAmericas
FDA Medical Device
Premarket Cybersecurity Guidance: SBOM submission, component inventory, patch management.
Premarket Cybersecurity Guidance: SBOM submission, component inventory, patch management.
| Short name | FDA MDS |
| Region | Americas |
| Country or scope | United States |
| Sector | Healthcare |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers FDA MDS
- Scan requirements: 6, all decided by a scan.
- Controls: the scan requirements below, plus 14 controls from Safeguard's control catalog for FDA MDS.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 26: 4 written for FDA MDS and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
FDA-524B-SBOM SBOM Submission | Sponsors of cyber devices must provide an SBOM covering commercial, open-source and off-the-shelf software components, in a machine-readable format per FDA guidance (FD&C Act s. 524B(b)(3); FDA 2023 Premarket Cybersecurity Guidance) | Scan |
FDA-524B-INV Complete Component Inventory | The device SBOM must enumerate the software components contained in the device so the total product lifecycle risk can be assessed (FD&C Act s. 524B(b)(3)) | Scan |
FDA-524B-VER Component Versions for Patch Management | FDA's guidance expects SBOM entries to include the version of each component so vulnerabilities can be monitored and patched across the device's lifecycle (FDA 2023 Premarket Cybersecurity Guidance - SBOM data elements) | Scan |
FDA-524B-SUP Component Manufacturer Attribution | SBOM entries should identify the manufacturer/supplier of each component, including the level of support, so off-the-shelf software risk can be evaluated (FDA 2023 Premarket Cybersecurity Guidance - SBOM data elements) | Scan |
FDA-524B-VULN Postmarket Vulnerability Monitoring | Manufacturers must monitor, identify and address postmarket vulnerabilities in a reasonable time, requiring components identifiable against vulnerability databases (FD&C Act s. 524B(b)(1)) | Scan |
FDA-524B-INT Device Software Integrity | Premarket cybersecurity controls include ensuring the integrity and authenticity of device software and updates, supported by cryptographic hashes over components (FDA 2023 Premarket Cybersecurity Guidance - integrity controls) | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
V.A.1 | Establish a Software Bill of Materials (SBOM) |
V.A.2 | Implement Threat Modeling for Device Software |
V.A.3 | Apply Security Controls by Design |
V.A.4 | Conduct Cybersecurity Testing |
V.B.1 | Establish a Coordinated Vulnerability Disclosure Policy |
V.B.2 | Monitor for Cybersecurity Vulnerabilities Post-Market |
V.B.3 | Remediate and Patch Vulnerabilities Timely |
VI.A.1 | Submit Cybersecurity Documentation in Premarket Submissions |
VI.B.1 | Implement Secure Software Update Mechanism |
VI.B.2 | Protect Credentials and Authentication |
VI.C.1 | Protect Data in Transit and at Rest |
VI.D.1 | Maintain Device Audit Logs |
VII.A.1 | Adopt a Cybersecurity Framework |
VII.B.1 | Provide Customer Cybersecurity Guidance |
Policy templates
Written for FDA MDS:
- FDA Premarket Cybersecurity Documentation Policy
- FDA Post-Market Cybersecurity Vulnerability Management Policy
- FDA Secure Product Development Lifecycle Policy
- FDA Medical Device Access Control and Authentication Policy
And 22 from the standard set, adapted to FDA MDS.