Skip to main content

FDA Overhauls Medical Device Cybersecurity Guidance, Unifying Rules for 'Cyber Devices'

· 3 min read
SBD Community
SBD Community
Maintainer

On June 27, 2025, the US Food and Drug Administration (FDA) published a landmark update to its premarket cybersecurity guidance, superseding the version from September 2023. This new document provides critical clarity for medical device manufacturers by consolidating previous guidances and formally defining the legal obligations for "cyber devices" under Section 524B of the FD&C Act.

As noted by industry experts like Leo Eisner on LinkedIn, this is a significant and welcome clarification. At a high level, the updated guidance creates a more unified and predictable regulatory framework by making one major structural change.

The Core Change: A New Section for "Cyber Devices"​

The most important change is the introduction of a new Section VII, "Cyber Devices." This section acts as the new center of gravity for the document. It unifies the previous 2023 premarket guidance and the 2024 "Select Updates" document, creating a single, authoritative home for the legally-mandated requirements for any device that meets the definition of a "cyber device."

For manufacturers, this means there is now a clear, consolidated reference for understanding the specific documentation, lifecycle management, and security architecture obligations required to achieve a "reasonable assurance of cybersecurity" under the law.

For a full breakdown of the FDA's requirements and how they impact your development process, see our updated US FDA Cybersecurity Overview.

Detailed Analysis: 2023 vs 2025 Versions​

For those interested in a deeper dive, a direct comparison between the 2023 and 2025 documents reveals four categories of change that, together, represent a significant refactoring of the FDA's guidance.

1. Major Structural Reorganization​

As mentioned, the addition of Section VII is the biggest change. It fundamentally reframes the document from a monolithic set of recommendations into a two-part structure: general best practices and specific legal requirements for "cyber devices." The content from the five appendices in the 2023 version has been absorbed and re-contextualized within this new structure, making the entire document more cohesive.

The new structure creates a noticeable shift in tone. The 2023 version read as strong "recommendations," whereas the 2025 version reads more like a legal interpretation. It constantly and explicitly maps its points back to the legal text of the FD&C Act. The message is no longer just "this is best practice," but "this is how you demonstrate compliance with the law."

3. Specific Content and Reference Updates​

Beyond the restructuring, there are important content updates:

  • New Terminology: The definition for "Uncontrolled risk" has been replaced with a new definition for "Controlled Risk," a subtle but important move from a negative to a positive framing.
  • Updated Standards: The guidance now references newer standards, most notably ANSI/AAMI SW96 for health software risk management.
  • Formal Citations: References to external documents, particularly from NIST, have been updated to include formal DOI (Digital Object Identifier) links, making them more stable and authoritative.

4. Granular Wording and Phrasing Refinements​

Finally, dozens of minor wording changes throughout the document improve its precision. Verbs are strengthened (e.g., assure becomes ensure), hyperlink text is made more descriptive, and overall consistency is improved, resulting in a more polished and professional final document.