CLAIMBOUND / SOURCE-PUBLICATION EVIDENCE
Medical devices
Every card identifies what it proves, what it does not prove, its exact quote, locator, source hash, and local rerun command.
1. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 5
Narrow public claim
Introduction With the increasing integration of wireless, Internet- and network-connected capabilities, portable media (e.g., USB or CD), and the frequent electronic exchange of medical devicerelated health information and other information, the need for robust cybersecurity controls to ensure medical device safety and effectiveness has become more important.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 5- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Introduction With the increasing integration of wireless, Internet- and network-connected capabilities, portable media (e.g., USB or CD), and the frequent electronic exchange of medical devicerelated health information and other information, the need for robust cybersecurity controls to ensure medical device safety and effectiveness has become more important.
2. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 5
Narrow public claim
In addition, cybersecurity threats to the healthcare sector have become more frequent and more severe, carrying increased potential for clinical impact.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 5- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
In addition, cybersecurity threats to the healthcare sector have become more frequent and more severe, carrying increased potential for clinical impact.
3. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 6
Narrow public claim
Furthermore, this guidance applies to all types of devices within the meaning of section 201(h) of the FD&C Act, including devices that meet the definition of a biological product under section of the Public Health Service Act, whether or not they require a premarket submission.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 6- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Furthermore, this guidance applies to all types of devices within the meaning of section 201(h) of the FD&C Act, including devices that meet the definition of a biological product under section of the Public Health Service Act, whether or not they require a premarket submission.
4. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 6
Narrow public claim
Therefore, the recommendations in this guidance also apply to devices for which a premarket submission is not required (e.g., for 510(k)-exempt devices).
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 6- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Therefore, the recommendations in this guidance also apply to devices for which a premarket submission is not required (e.g., for 510(k)-exempt devices).
5. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 7
Narrow public claim
For more information, contact the FDA review division that will have the lead review for the combination product.4 As IDE submissions have a different benefit-risk threshold and are not marketing authorizations, specific recommendations for IDE submission documentation are provided in Appendix 3.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 7- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
For more information, contact the FDA review division that will have the lead review for the combination product.4 As IDE submissions have a different benefit-risk threshold and are not marketing authorizations, specific recommendations for IDE submission documentation are provided in Appendix 3.
6. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 7
Narrow public claim
Vulnerabilities identified in commonly used third-party components, like URGENT/117 and SweynTooth,8 have led to potential safety concerns across a broad range of devices that are used in various clinical specialties.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 7- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Vulnerabilities identified in commonly used third-party components, like URGENT/117 and SweynTooth,8 have led to potential safety concerns across a broad range of devices that are used in various clinical specialties.
7. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 8
Narrow public claim
One way these TPLC considerations for devices can be achieved is through the implementation and adoption of a Secure Product Development Framework (SPDF).10 An SPDF, as described in this guidance, is a set of processes that reduces the number and severity of vulnerabilities in products throughout the device lifecycle.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 8- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
One way these TPLC considerations for devices can be achieved is through the implementation and adoption of a Secure Product Development Framework (SPDF).10 An SPDF, as described in this guidance, is a set of processes that reduces the number and severity of vulnerabilities in products throughout the device lifecycle.
8. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 8
Narrow public claim
The QMSR incorporates by reference the 2016 edition of ISO 13485.12 By incorporating ISO by reference, we are explicitly requiring current internationally recognized regulatory expectations for QMS for devices subject to FDA’s jurisdiction.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 8- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
The QMSR incorporates by reference the 2016 edition of ISO 13485.12 By incorporating ISO by reference, we are explicitly requiring current internationally recognized regulatory expectations for QMS for devices subject to FDA’s jurisdiction.
9. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 9
Narrow public claim
The recommendations in this guidance are intended to help manufacturers meet their obligations under section 524B of the FD&C Act.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 9- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
The recommendations in this guidance are intended to help manufacturers meet their obligations under section 524B of the FD&C Act.
10. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 9
Narrow public claim
The quality management systems requirements are found in the QMSR in 21 CFR Part 820, which incorporates by reference ISO 13485.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 9- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
The quality management systems requirements are found in the QMSR in 21 CFR Part 820, which incorporates by reference ISO 13485.
11. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 10
Narrow public claim
For example, 21 CFR 820.10(c) requires that for all classes of devices automated with software, a manufacturer must comply with the requirements in Design and Development, Clause 7.3 and its subclauses of ISO 13485.18 As part of design and development, “[d]esign and development validation shall be performed in accordance with planned and documented arrangements to ensure that the resulting product is capable of meeting the requirements for the specified application or intended use” (Subclause 7.3.7).
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 10- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
For example, 21 CFR 820.10(c) requires that for all classes of devices automated with software, a manufacturer must comply with the requirements in Design and Development, Clause 7.3 and its subclauses of ISO 13485.18 As part of design and development, “[d]esign and development validation shall be performed in accordance with planned and documented arrangements to ensure that the resulting product is capable of meeting the requirements for the specified application or intended use” (Subclause 7.3.7).
12. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 10
Narrow public claim
In addition, Subclause 7.1 of ISO 13485 specifies that the “organization shall document one or more processes for risk management in product realization.” As part of the software validation required by Subclause 7.3.7, and risk management, including the requirements of Subclause 7.1, software device manufacturers may need to establish cybersecurity risk management and validation processes, where appropriate.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 10- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
In addition, Subclause 7.1 of ISO 13485 specifies that the “organization shall document one or more processes for risk management in product realization.” As part of the software validation required by Subclause 7.3.7, and risk management, including the requirements of Subclause 7.1, software device manufacturers may need to establish cybersecurity risk management and validation processes, where appropriate.
13. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 11
Narrow public claim
An SPDF can be integrated with existing processes for product and software development, risk management, and the quality management system at large.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 11- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
An SPDF can be integrated with existing processes for product and software development, risk management, and the quality management system at large.
14. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 11
Narrow public claim
Because of its benefits in helping comply with the QMSR and cybersecurity, FDA encourages manufacturers to use an SPDF, but other approaches might also satisfy the QMSR.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 11- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Because of its benefits in helping comply with the QMSR and cybersecurity, FDA encourages manufacturers to use an SPDF, but other approaches might also satisfy the QMSR.
15. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 12
Narrow public claim
Transparency A lack of cybersecurity information, such as information necessary to integrate the device into the use environment, as well as information needed by users to maintain the medical device system’s cybersecurity over the device lifecycle, has the potential to affect the safety and effectiveness of a device.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 12- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Transparency A lack of cybersecurity information, such as information necessary to integrate the device into the use environment, as well as information needed by users to maintain the medical device system’s cybersecurity over the device lifecycle, has the potential to affect the safety and effectiveness of a device.
16. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 12
Narrow public claim
In order to address these concerns, it is important for device users to have access to information pertaining to the device’s cybersecurity controls, potential risks to the medical device system, and other relevant information.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 12- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
In order to address these concerns, it is important for device users to have access to information pertaining to the device’s cybersecurity controls, potential risks to the medical device system, and other relevant information.
17. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 13
Narrow public claim
For cyber devices, failure to comply with any requirement under section 524B(b)(2)of the FD&C Act (relating to ensuring device cybersecurity) is considered a prohibited act under section 301(q) of the FD&C Act.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 13- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
For cyber devices, failure to comply with any requirement under section 524B(b)(2)of the FD&C Act (relating to ensuring device cybersecurity) is considered a prohibited act under section 301(q) of the FD&C Act.
18. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 13
Narrow public claim
For cyber devices, some of the information recommended in this guidance may help manufacturers meet their obligations for what is required to be in premarket submissions under section 524B of the FD&C Act.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 13- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
For cyber devices, some of the information recommended in this guidance may help manufacturers meet their obligations for what is required to be in premarket submissions under section 524B of the FD&C Act.
19. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 14
Narrow public claim
Possible frameworks to consider include, but are not limited to, the medical device-specific framework that can be found in the Medical Device and Health IT Joint Security Plan (JSP2)26 and IEC 81001-5-1.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 14- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Possible frameworks to consider include, but are not limited to, the medical device-specific framework that can be found in the Medical Device and Health IT Joint Security Plan (JSP2)26 and IEC 81001-5-1.
20. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 14
Narrow public claim
These recommendations may be helpful for manufacturers of cyber devices that must “design, develop, and maintain processes and procedures to provide a reasonable assurance that the device and related systems are cybersecure . . .” pursuant to section 524B(b)(2) of the FD&C Act (see Section VII.C.2).
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 14- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
These recommendations may be helpful for manufacturers of cyber devices that must “design, develop, and maintain processes and procedures to provide a reasonable assurance that the device and related systems are cybersecure . . .” pursuant to section 524B(b)(2) of the FD&C Act (see Section VII.C.2).
21. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 15
Narrow public claim
Security risk management should be an integrated part of a manufacturer’s entire quality management system, addressed throughout the TPLC.28 The quality management system processes entail the technical, personnel, and management practices, among others, that manufacturers use to manage potential risks to their devices and ensure that their devices are, and once on the market, remain, safe and effective, which includes security.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 15- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Security risk management should be an integrated part of a manufacturer’s entire quality management system, addressed throughout the TPLC.28 The quality management system processes entail the technical, personnel, and management practices, among others, that manufacturers use to manage potential risks to their devices and ensure that their devices are, and once on the market, remain, safe and effective, which includes security.
22. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 15
Narrow public claim
The processes in ISO 13485, as incorporated by reference in the QMSR, that may be relevant in this context include, but are not limited to design and development (Subclause 7.3 of ISO 13485), production processes (Subclause 7.5), and improvement (including corrective actions and preventive actions) (Subclause 8.5) to ensure both safety and security risks are adequately addressed.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 15- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
The processes in ISO 13485, as incorporated by reference in the QMSR, that may be relevant in this context include, but are not limited to design and development (Subclause 7.3 of ISO 13485), production processes (Subclause 7.5), and improvement (including corrective actions and preventive actions) (Subclause 8.5) to ensure both safety and security risks are adequately addressed.
23. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 16
Narrow public claim
To document the security risk management activities for a medical device system, FDA recommends that manufacturers generate a security risk management plan and report such as that described in AAMI TIR57 and ANSI/AAMI SW96.32 Manufacturers should include their security risk management reports—including the outputs of their security risk management processes—in their premarket submissions to help demonstrate the safety and effectiveness of the device.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 16- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
To document the security risk management activities for a medical device system, FDA recommends that manufacturers generate a security risk management plan and report such as that described in AAMI TIR57 and ANSI/AAMI SW96.32 Manufacturers should include their security risk management reports—including the outputs of their security risk management processes—in their premarket submissions to help demonstrate the safety and effectiveness of the device.
24. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 16
Narrow public claim
A security risk management report, such as that described in AAMI TIR57 and ANSI/AAMI SW96, should be sufficient to support the security risk management process aspect of demonstrating a reasonable assurance of safety and effectiveness.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 16- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
A security risk management report, such as that described in AAMI TIR57 and ANSI/AAMI SW96, should be sufficient to support the security risk management process aspect of demonstrating a reasonable assurance of safety and effectiveness.
25. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 17
Narrow public claim
It is foundational for optimizing system, product, network, application, and connection security when applied appropriately and comprehensively.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 17- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
It is foundational for optimizing system, product, network, application, and connection security when applied appropriately and comprehensively.
26. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 17
Narrow public claim
There are a number of methodologies and/or combinations of methods for threat modeling that manufacturers may choose to use.34 Rationale for the methodology(ies) selected should be provided with the threat modeling documentation.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 17- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
There are a number of methodologies and/or combinations of methods for threat modeling that manufacturers may choose to use.34 Rationale for the methodology(ies) selected should be provided with the threat modeling documentation.
27. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 18
Narrow public claim
This non-probabilistic approach is not the fundamental approach performed in safety risk management under ISO 14971 and further underscores why safety and security risk management are distinct but connected processes.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 18- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
This non-probabilistic approach is not the fundamental approach performed in safety risk management under ISO 14971 and further underscores why safety and security risk management are distinct but connected processes.
28. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 18
Narrow public claim
FDA recommends that manufacturers assess identified risks according to the level of risk posed from the device and the system in which it operates.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 18- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
FDA recommends that manufacturers assess identified risks according to the level of risk posed from the device and the system in which it operates.
29. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 19
Narrow public claim
As discussed in FDA’s guidance “Off-The-Shelf (OTS) Software Use in Medical Devices,” medical devices commonly include third-party software components,35 including off-the-shelf and open source software.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 19- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
As discussed in FDA’s guidance “Off-The-Shelf (OTS) Software Use in Medical Devices,” medical devices commonly include third-party software components,35 including off-the-shelf and open source software.
30. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 19
Narrow public claim
As part of demonstrating compliance with design and development under Subclause 7.3 of ISO 13485, and to support supply chain risk management processes, all software, including those developed by the device manufacturer (“proprietary software”) or obtained from third parties, should be assessed for cybersecurity risk.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 19- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
As part of demonstrating compliance with design and development under Subclause 7.3 of ISO 13485, and to support supply chain risk management processes, all software, including those developed by the device manufacturer (“proprietary software”) or obtained from third parties, should be assessed for cybersecurity risk.
31. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 20
Narrow public claim
As a result, device manufacturers should establish and maintain custodial control of device source code (the original “copy” of the software) throughout the lifecycle of a device as part of configuration management.36 This may be accomplished through different methods, such as source code escrow or source code backups, among others.37 Manufacturers may not have control of source code due to licensing restrictions, terms of supplier agreements, or other challenges.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 20- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
As a result, device manufacturers should establish and maintain custodial control of device source code (the original “copy” of the software) throughout the lifecycle of a device as part of configuration management.36 This may be accomplished through different methods, such as source code escrow or source code backups, among others.37 Manufacturers may not have control of source code due to licensing restrictions, terms of supplier agreements, or other challenges.
32. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 20
Narrow public claim
While source code is not required to be provided in premarket submissions, manufacturers should include plans for how third-party software components could be updated or replaced if support ends or other software issues arise in premarket submissions.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 20- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
While source code is not required to be provided in premarket submissions, manufacturers should include plans for how third-party software components could be updated or replaced if support ends or other software issues arise in premarket submissions.
33. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 21
Narrow public claim
To assist FDA’s assessment of the device risks and associated impacts on safety and effectiveness related to cybersecurity, FDA recommends that premarket submissions include SBOM documentation as outlined below.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 21- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
To assist FDA’s assessment of the device risks and associated impacts on safety and effectiveness related to cybersecurity, FDA recommends that premarket submissions include SBOM documentation as outlined below.
34. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 21
Narrow public claim
For cyber devices, an SBOM is required (see section 524B(b)(3) of the FD&C Act and Section VII.C.3 of this guidance).
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 21- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
For cyber devices, an SBOM is required (see section 524B(b)(3) of the FD&C Act and Section VII.C.3 of this guidance).
35. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 22
Narrow public claim
As a part of ensuring a complete security risk assessment under Subclause 7.1 of ISO 13485, the assessment for impacts to safety and effectiveness may include an assessment for the potential security impacts of anomalies.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 22- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
As a part of ensuring a complete security risk assessment under Subclause 7.1 of ISO 13485, the assessment for impacts to safety and effectiveness may include an assessment for the potential security impacts of anomalies.
36. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 22
Narrow public claim
The assessment should also include consideration of any present Common Weakness Enumeration (CWE) categories.39 For example, a clinical user may inadvertently reveal the presence of a previously unknown software anomaly during normal use, where the impact of the anomaly might occur sporadically and be assessed to be acceptable from a software risk perspective.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 22- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
The assessment should also include consideration of any present Common Weakness Enumeration (CWE) categories.39 For example, a clinical user may inadvertently reveal the presence of a previously unknown software anomaly during normal use, where the impact of the anomaly might occur sporadically and be assessed to be acceptable from a software risk perspective.
37. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 23
Narrow public claim
Additional information as to whether a new premarket submission (e.g., PMA, PMA supplement, or 510(k)) or 21 CFR Part 806 reporting is needed based on postmarket vulnerabilities and general postmarket cybersecurity risk management is discussed in the Postmarket Cybersecurity Guidance.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 23- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Additional information as to whether a new premarket submission (e.g., PMA, PMA supplement, or 510(k)) or 21 CFR Part 806 reporting is needed based on postmarket vulnerabilities and general postmarket cybersecurity risk management is discussed in the Postmarket Cybersecurity Guidance.
38. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 24
Narrow public claim
Under Subclause 7.3.2, a manufacturer must establish and maintain plans that describe or reference the design and development activities and define responsibility for implementation.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 24- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Under Subclause 7.3.2, a manufacturer must establish and maintain plans that describe or reference the design and development activities and define responsibility for implementation.
39. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 24
Narrow public claim
Under Subclause 7.3.3, a manufacturer must determine and maintain inputs related to product requirements to ensure that the design requirements relating to a device are appropriate and address the intended use of the device.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 24- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Under Subclause 7.3.3, a manufacturer must determine and maintain inputs related to product requirements to ensure that the design requirements relating to a device are appropriate and address the intended use of the device.
40. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 25
Narrow public claim
FDA recommends that device manufacturers’ design processes include design and development inputs for cybersecurity controls.44 FDA recommends that these procedures include design requirements and acceptance criteria for the security features built into the device such that they holistically address the cybersecurity considerations for the device and the system in which the device operates.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 25- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
FDA recommends that device manufacturers’ design processes include design and development inputs for cybersecurity controls.44 FDA recommends that these procedures include design requirements and acceptance criteria for the security features built into the device such that they holistically address the cybersecurity considerations for the device and the system in which the device operates.
41. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 25
Narrow public claim
For each of the security control categories above, specific control recommendations and implementation guidance to avoid common pitfalls are detailed in Appendix 1.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 25- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
For each of the security control categories above, specific control recommendations and implementation guidance to avoid common pitfalls are detailed in Appendix 1.
42. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 26
Narrow public claim
Manufacturers should submit documentation in their premarket submissions demonstrating that the security controls for the categories above, and further detailed in the recommendations in Appendix 1, have (1) been implemented, and (2) been tested in order to validate that they were effectively implemented.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 26- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Manufacturers should submit documentation in their premarket submissions demonstrating that the security controls for the categories above, and further detailed in the recommendations in Appendix 1, have (1) been implemented, and (2) been tested in order to validate that they were effectively implemented.
43. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 26
Narrow public claim
In addition to the design and development requirements,46 Subclause 8.5 of ISO 13485 requires that manufacturers establish and maintain procedures for implementing improvement, including corrective action and preventive action.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 26- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
In addition to the design and development requirements,46 Subclause 8.5 of ISO 13485 requires that manufacturers establish and maintain procedures for implementing improvement, including corrective action and preventive action.
44. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 27
Narrow public claim
For the security architecture views, manufacturers should follow the recommendations outlined in Appendix 2 when determining the level of detail to include in premarket submissions.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 27- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
For the security architecture views, manufacturers should follow the recommendations outlined in Appendix 2 when determining the level of detail to include in premarket submissions.
45. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 28
Narrow public claim
Additional views can be provided that detail the communication specifics as recommended in Appendix 2 and do not need to be duplicated if captured in one of the other types of views detailed below.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 28- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Additional views can be provided that detail the communication specifics as recommended in Appendix 2 and do not need to be duplicated if captured in one of the other types of views detailed below.
46. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 28
Narrow public claim
Because of that connectivity, if a device is compromised, or if a non-device function (i.e., any function that does not fall within section 201(h) of the FD&C Act) that could impact the device function is compromised, the device may introduce a safety risk to patients through security risk.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 28- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Because of that connectivity, if a device is compromised, or if a non-device function (i.e., any function that does not fall within section 201(h) of the FD&C Act) that could impact the device function is compromised, the device may introduce a safety risk to patients through security risk.
47. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 29
Narrow public claim
Under Subclause 7.3.6 of ISO 13485, a manufacturer must establish and maintain procedures for verifying the device design.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 29- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Under Subclause 7.3.6 of ISO 13485, a manufacturer must establish and maintain procedures for verifying the device design.
48. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 30
Narrow public claim
As discussed in Sections V.A.2 and V.A.3 above, vulnerabilities and anomalies identified during testing should be assessed for their security impacts as part of the security risk management process.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 30- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
As discussed in Sections V.A.2 and V.A.3 above, vulnerabilities and anomalies identified during testing should be assessed for their security impacts as part of the security risk management process.
49. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 31
Narrow public claim
There are numerous authoritative resources for outlining security testing that may partially fulfill the testing outlined above.48 FDA recommends that cybersecurity testing should occur throughout the SPDF.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 31- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
There are numerous authoritative resources for outlining security testing that may partially fulfill the testing outlined above.48 FDA recommends that cybersecurity testing should occur throughout the SPDF.
50. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 31
Narrow public claim
Cybersecurity Transparency Cybersecurity transparency is critical to ensure safe and effective use and integration of devices and systems.49 This transparency can be conveyed through both device labeling and the establishment of manufacturer vulnerability management plans.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 31- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Cybersecurity Transparency Cybersecurity transparency is critical to ensure safe and effective use and integration of devices and systems.49 This transparency can be conveyed through both device labeling and the establishment of manufacturer vulnerability management plans.
51. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 32
Narrow public claim
Any risks transferred to the user should be detailed and considered for inclusion as tasks during usability testing (e.g., human factors testing)50 to ensure that the type of user has the capability to take appropriate actions to manage those risks.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 32- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Any risks transferred to the user should be detailed and considered for inclusion as tasks during usability testing (e.g., human factors testing)50 to ensure that the type of user has the capability to take appropriate actions to manage those risks.
52. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 34
Narrow public claim
Cybersecurity Management Plans Recognizing that cybersecurity risks evolve as technology evolves throughout a device’s TPLC, FDA recommends that manufacturers establish a plan for how they will identify and communicate to the relevant parties the vulnerabilities that are identified after releasing the device in accordance with Subclause 8.4 and Subclause 8.5 of ISO 13485, and 21 CFR Part 806, as appropriate.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 34- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Cybersecurity Management Plans Recognizing that cybersecurity risks evolve as technology evolves throughout a device’s TPLC, FDA recommends that manufacturers establish a plan for how they will identify and communicate to the relevant parties the vulnerabilities that are identified after releasing the device in accordance with Subclause 8.4 and Subclause 8.5 of ISO 13485, and 21 CFR Part 806, as appropriate.
53. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 34
Narrow public claim
This plan can also support security risk management processes that are described throughout the QMSR and ISO 13485, as incorporated by reference in the QMSR.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 34- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
This plan can also support security risk management processes that are described throughout the QMSR and ISO 13485, as incorporated by reference in the QMSR.
54. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 37
Narrow public claim
We consider an update or patch that would satisfy the requirements under section 524B(b)(2)(A)-(B) for updates or patches as an action that modifies device code to address a cyber risk.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 37- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
We consider an update or patch that would satisfy the requirements under section 524B(b)(2)(A)-(B) for updates or patches as an action that modifies device code to address a cyber risk.
55. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 38
Narrow public claim
Doing so will allow manufacturers to quickly identify vulnerability impacts once a device is released and could also help satisfy the patching requirements of section 524B(b)(2)(A)-(B) of the FD&C Act.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 38- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Doing so will allow manufacturers to quickly identify vulnerability impacts once a device is released and could also help satisfy the patching requirements of section 524B(b)(2)(A)-(B) of the FD&C Act.
56. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 38
Narrow public claim
The required plans,69 as well as the processes and procedures discussed in Section VII.C.2 below,70 also should, as appropriate, account for any differences in the risk management for fielded devices (e.g., differences between marketed devices and devices no longer marketed but still in use).
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 38- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
The required plans,69 as well as the processes and procedures discussed in Section VII.C.2 below,70 also should, as appropriate, account for any differences in the risk management for fielded devices (e.g., differences between marketed devices and devices no longer marketed but still in use).
57. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 39
Narrow public claim
Overall, we recommend that manufacturers use the recommendations below to determine the information FDA recommends manufacturers of cyber devices provide to demonstrate they have met the new requirements under section 524B when submitting a premarket submission for a device modification.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 39- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Overall, we recommend that manufacturers use the recommendations below to determine the information FDA recommends manufacturers of cyber devices provide to demonstrate they have met the new requirements under section 524B when submitting a premarket submission for a device modification.
58. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 39
Narrow public claim
For these types of changes, see Section VII.C for required and recommended documentation to be included with each premarket submission (see section 524B of the FD&C Act).
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 39- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
For these types of changes, see Section VII.C for required and recommended documentation to be included with each premarket submission (see section 524B of the FD&C Act).
59. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 40
Narrow public claim
To assist with complying with this requirement, we recommend that a manufacturer of a cyber device provide an SBOM that contains the information recommended in Section V.A.4.b above.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 40- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
To assist with complying with this requirement, we recommend that a manufacturer of a cyber device provide an SBOM that contains the information recommended in Section V.A.4.b above.
60. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 40
Narrow public claim
Moreover, a determination that there is a reasonable assurance of cybersecurity is relevant to the various premarket pathways and authorization under them, specifically, FDA’s review of a 510(k), PMA, PDP, De Novo, and HDE.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 40- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Moreover, a determination that there is a reasonable assurance of cybersecurity is relevant to the various premarket pathways and authorization under them, specifically, FDA’s review of a 510(k), PMA, PDP, De Novo, and HDE.
61. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 42
Narrow public claim
Security Control Categories and Associated Recommendations The following sections provide detailed descriptions of each of the security control categories introduced in Section V.B.1, as well as specific recommendations for security controls and their implementation, to avoid common pitfalls.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 42- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Security Control Categories and Associated Recommendations The following sections provide detailed descriptions of each of the security control categories introduced in Section V.B.1, as well as specific recommendations for security controls and their implementation, to avoid common pitfalls.
62. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 42
Narrow public claim
Authentication of information75 exists where the device and the system in which it operates are able to prove that information originated at a known and trusted source, and that the information has not been altered in transit between the original source and the point at which authenticity is verified.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 42- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Authentication of information75 exists where the device and the system in which it operates are able to prove that information originated at a known and trusted source, and that the information has not been altered in transit between the original source and the point at which authenticity is verified.
63. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 44
Narrow public claim
Within an adequately designed authorization scheme, the principle of least privileges77 should be applied to users, system functions, and others, to only allow those entities the levels of system access necessary to perform a specific function.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 44- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Within an adequately designed authorization scheme, the principle of least privileges77 should be applied to users, system functions, and others, to only allow those entities the levels of system access necessary to perform a specific function.
64. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 44
Narrow public claim
While authentication schemes based on cryptographically proven designs are generally considered more robust and are therefore preferred, meaningful authorization checks can be performed based on other compelling evidence (e.g., benefit/risk assessment in accordance with AAMI TIR57 or ANSI/AAMI SW96 and associated supporting justification and as evidenced through security testing).
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 44- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
While authentication schemes based on cryptographically proven designs are generally considered more robust and are therefore preferred, meaningful authorization checks can be performed based on other compelling evidence (e.g., benefit/risk assessment in accordance with AAMI TIR57 or ANSI/AAMI SW96 and associated supporting justification and as evidenced through security testing).
65. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 47
Narrow public claim
Confidentiality Manufacturers should ensure support for the confidentiality82 of any/all data whose disclosure could lead to patient harm (e.g., through the unauthorized use of otherwise valid credentials, lack of encryption).
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 47- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Confidentiality Manufacturers should ensure support for the confidentiality82 of any/all data whose disclosure could lead to patient harm (e.g., through the unauthorized use of otherwise valid credentials, lack of encryption).
66. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 51
Narrow public claim
Submission Documentation for Security Architecture Flows In premarket submissions, FDA recommends that manufacturers provide detailed information for the views identified in Section V.B.2.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 51- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Submission Documentation for Security Architecture Flows In premarket submissions, FDA recommends that manufacturers provide detailed information for the views identified in Section V.B.2.
67. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 51
Narrow public claim
The diagrams may also include items from the information details identified below for the architecture views identified in Section V.B.2 if the information is better represented or conveyed through a diagram than explanatory text alone.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 51- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
The diagrams may also include items from the information details identified below for the architecture views identified in Section V.B.2 if the information is better represented or conveyed through a diagram than explanatory text alone.
68. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 55
Narrow public claim
As mentioned previously, the submission documentation recommendations in this guidance are intended to help manufacturers meet their obligations for cyber devices under section 524B of the FD&C Act.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 55- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
As mentioned previously, the submission documentation recommendations in this guidance are intended to help manufacturers meet their obligations for cyber devices under section 524B of the FD&C Act.
69. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 60
Narrow public claim
Exploitability – the feasibility or ease and technical means by which the vulnerability can be exploited by a threat.103 Firmware – software program or set of instructions programmed on the flash read-only memory (ROM) of a hardware device.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 60- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Exploitability – the feasibility or ease and technical means by which the vulnerability can be exploited by a threat.103 Firmware – software program or set of instructions programmed on the flash read-only memory (ROM) of a hardware device.
70. FDA Cybersecurity in Medical Devices Guidance (February 2026) · PDF page 62
Narrow public claim
Software Bill of Materials (SBOM) – a formal inventory of software components and dependencies, information about those components, and their hierarchical relationships.117 The software components in an SBOM include, but are not limited to, commercial, open source, offthe-shelf, and custom software components.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-11, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- FDA Cybersecurity in Medical Devices Guidance (February 2026)
- Section locator
PDF page 62- Captured
- 2026-08-11
- Source SHA-256
d046fa836048933e1a8795bcf2f8224bcfa08789c2f3ef6f46ae53c2eb096c54- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom020_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Software Bill of Materials (SBOM) – a formal inventory of software components and dependencies, information about those components, and their hierarchical relationships.117 The software components in an SBOM include, but are not limited to, commercial, open source, offthe-shelf, and custom software components.