Post-Market Security Management

Cybersecurity responsibilities continue throughout the device lifecycle with ongoing monitoring, vulnerability management, and customer communication requirements.

Getting a medical device cleared is the start of your cybersecurity obligations, and this chapter covers everything that comes after. FDA's 2016 postmarket cybersecurity guidance, now reinforced by Section 524B of the FD&C Act, expects manufacturers to monitor for new vulnerabilities, assess and respond to risk, patch deployed devices, and keep customers and regulators informed for as long as the device is in clinical use. The chapter opens with the shared responsibility model: manufacturers develop patches and communicate risk, healthcare facilities apply updates and secure their networks, users follow procedures and report problems, and FDA monitors safety signals and enforces requirements.

The middle sections walk through the operational core of a post-market program. You'll see how to build a vulnerability monitoring program around your SBOM, using sources like the National Vulnerability Database and the CISA Known Exploited Vulnerabilities catalog, with monitoring frequency tiered by component risk. From there the chapter covers structured vulnerability assessment (exploitability analysis, impact analysis, and risk scoring with the MITRE medical device CVSS rubric), patch development and secure distribution, and coordinated vulnerability disclosure, including a sample CVD policy and disclosure timelines researchers will actually accept.

The later sections cover the supporting functions that keep the program running: H-ISAC information sharing, customer security advisories with notification timelines based on risk, incident response roles and severity classification, and the metrics that tell you whether any of it works, like time to assess, time to patch, and deployment rates. The chapter closes with resource planning for a sustainable team and budget, five common pitfalls (starting with "set and forget" monitoring), emerging challenges like AI vulnerabilities and ransomware, and how to assemble a post-market playbook you can exercise before you need it for real.