This site displays a prototype of a “Web 2.0” version of the daily Federal Register. It is not an official legal edition of the Federal Register, and does not replace the official print version or the official electronic version on GPO’s govinfo.gov.
The documents posted on this site are XML renditions of published Federal Register documents. Each document posted on the site includes a link to the corresponding official PDF file on govinfo.gov. This prototype edition of the daily Federal Register on FederalRegister.gov will remain an unofficial informational resource until the Administrative Committee of the Federal Register (ACFR) issues a regulation granting it official legal status. For complete information about, and access to, our official publications and services, go to About the Federal Register on NARA's archives.gov.
The OFR/GPO partnership is committed to presenting accurate and reliable regulatory information on FederalRegister.gov with the objective of establishing the XML-based Federal Register as an ACFR-sanctioned publication in the future. While every effort has been made to ensure that the material on FederalRegister.gov is accurately displayed, consistent with the official SGML-based PDF version on govinfo.gov, those relying on it for legal research should verify their results against an official edition of the Federal Register. Until the ACFR grants it official status, the XML rendition of the daily Federal Register on FederalRegister.gov does not provide legal notice to the public or judicial notice to the courts.
FederalRegister.gov retrieves relevant information about this document from Regulations.gov to provide users with additional context. This information is not part of the official Federal Register document.
Food and Drug Administration, HHS.
Notice of availability.
The Food and Drug Administration (FDA or Agency) is announcing the availability of the draft guidance entitled “Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions.” As more medical devices are becoming interconnected, cybersecurity threats have become more numerous, more frequent, more severe, and more clinically impactful. As a result, ensuring medical device safety and effective includes adequate medical device cybersecurity, as well as its security as part of the larger system. In 2018, FDA proposed updates to the final guidance, “Content of Premarket Submissions for Management of Cybersecurity in Medical Devices,” and issued a draft guidance of the same name. This draft guidance replaces the 2018 draft guidance. This draft guidance is intended to further emphasize the importance of ensuring that devices are designed securely, are designed to be capable of mitigating emerging cybersecurity risks throughout the Total Product Life Cycle, and to clearly outline FDA's recommendations for premarket submission content to address cybersecurity concerns. This draft guidance is not final nor is it for implementation at this time.
Submit either electronic or written comments on the draft guidance by July 7, 2022 to ensure that the Agency considers your comment on this draft guidance before it begins work on the final version of the guidance.
You may submit comments on any guidance at any time as follows:
Submit electronic comments in the following way:
Submit written/paper submissions as follows:
Instructions: All submissions received must include the Docket No. FDA-2021-D-1158 for “Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions.” Received comments will be placed in the docket and, except for those submitted as “Confidential Submissions,” publicly viewable at https://www.regulations.gov or at the Dockets Management Staff between 9 a.m. and 4 p.m., Monday through Friday, 240-402-7500.
Docket: For access to the docket to read background documents or the electronic and written/paper comments received, go to https://www.regulations.gov and insert the docket number, found in brackets in the heading of this document, into the “Search” box and follow the prompts and/or go to the Dockets Management Staff, 5630 Fishers Lane, Rm. 1061, Rockville, MD 20852, 240-402-7500.
You may submit comments on any guidance at any time (see 21 CFR 10.115(g)(5)).
An electronic copy of the guidance document is available for download from the internet. See the SUPPLEMENTARY INFORMATION section for information on electronic access to the guidance. Submit written requests for a single hard copy of the draft guidance document entitled “Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions” to the Office of Policy, Guidance and Policy Development, Center for Devices and Radiological Health, Food and Drug Administration, 10903 New Hampshire Ave., Bldg. 66, Rm. 5431, Silver Spring, MD 20993-0002 or the Office of Communication, Outreach and Development, Center for Biologics Evaluation and Research (CBER), Food and Drug Administration, 10903 New Hampshire Ave., Bldg. 71, Rm. 3128, Silver Spring, MD 20993-0002. Send one self-addressed adhesive label to assist that office in processing your request.
Suzanne Schwartz, Center for Devices and Radiological Health, Food and Drug Administration, 10903 New Hampshire Ave., Bldg. 66, Rm. 5410, Silver Spring, MD 20993-0002, 301-796-6937; or Stephen Ripley, Center for Biologics Evaluation and Research, Food and Drug Administration, 10903 New Hampshire Ave., Bldg. 71, Rm. 7301, Silver Spring, MD 20993, 240-402-7911.
The need for effective cybersecurity to reasonably ensure medical device safety and effectiveness has become more important with the increasing use of wireless, internet- and network-connected devices, portable media ( e.g., USB or CD), and the frequent electronic exchange of medical device-related health information. In addition, cybersecurity threats to the healthcare sector have become more frequent, more severe, and carry increased potential for clinical impact. Cybersecurity incidents have rendered medical devices and hospital networks inoperable, disrupting the delivery of patient care across healthcare facilities in the United States and globally. Such cyber attacks and exploits can delay diagnoses and/or treatment and may lead to patient harm.
Although FDA issued guidance providing recommendations for device cybersecurity information in premarket submissions in 2014,[1] the rapidly evolving landscape, and the increased understanding of the threats and their potential mitigations, necessitate an updated approach. As such, FDA issued a draft guidance in 2018 entitled “Content of Premarket Submissions for Management of Cybersecurity in Medical Devices.”
Given the rapidly evolving device cybersecurity landscape, FDA is issuing this draft guidance, which replaces the 2018 draft guidance, to further emphasize the importance of ensuring that devices are designed securely, are designed to be capable of mitigating emerging cybersecurity risks throughout the Total Product Life Cycle, and to clearly outline FDA's recommendations for premarket submission content to address cybersecurity concerns, including device labeling. These recommendations can facilitate an efficient premarket review process and help ensure that marketed medical devices are sufficiently resilient to cybersecurity threats.
This draft guidance supplants the draft guidance entitled, “Content of Premarket Submissions for Management of Cybersecurity in Medical Devices” issued October 18, 2018, and takes into consideration comments received on the 2018 draft guidance (83 FR 52835; ( printed page 20875) https://www.govinfo.gov/content/pkg/FR-2018-10-18/pdf/2018-22697.pdf ) and input gained from the public workshop entitled, “Content of Premarket Submissions for Management of Cybersecurity in Medical devices” held on January 29-30, 2019.[2] Several changes were made in this draft guidance, including a change in title to better capture the scope of the current draft guidance, document structure change to align with use of a Secure Product Framework, removal of risk tiers, replacement of the Cybersecurity Bill of Materials with Software Bill of Materials, additional clarification regarding premarket submission document requests throughout the draft guidance, and addition of Investigational Device Exemptions to the scope.
This draft guidance is being issued consistent with FDA's good guidance practices regulation (21 CFR 10.115). The draft guidance, when finalized, will represent the current thinking of FDA on “Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions.” It does not establish any rights for any person and is not binding on FDA or the public. You can use an alternative approach if it satisfies the requirements of the applicable statutes and regulations.
Persons interested in obtaining a copy of the draft guidance may do so by downloading an electronic copy from the internet. A search capability for all Center for Devices and Radiological Health guidance documents is available at https://www.fda.gov/medical-devices/device-advice-comprehensive-regulatory-assistance/guidance-documents-medical-devices-and-radiation-emitting-products. This draft guidance is also available at https://www.regulations.gov and at https://www.fda.gov/regulatory-information/search-fda-guidance-documents or https://www.fda.gov/vaccines-blood-biologics/guidance-compliance-regulatory-information-biologics/biologics-guidances. Persons unable to download an electronic copy of “Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions” may send an email request to CDRH-Guidance@fda.hhs.gov to receive an electronic copy of the document. Please use the document number 1825-R1 and complete title to identify the guidance you are requesting.
While this guidance contains no collection of information, it does refer to previously approved FDA collections of information. Therefore, clearance by the Office of Management and Budget (OMB) under the Paperwork Reduction Act of 1995 (PRA) (44 U.S.C. 3501-3521) is not required for this guidance. The previously approved collections of information are subject to review by OMB under the PRA. The collections of information in the following FDA regulations, guidance, and forms have been approved by OMB as listed in the following table:
| 21 CFR part or guidance | Topic | OMB control No. |
|---|---|---|
| 807, subpart E | Premarket notification | 0910-0120 |
| 814, subparts A through E | Premarket approval | 0910-0231 |
| 814, subpart H | Humanitarian Device Exemption | 0910-0332 |
| 812 | Investigational Device Exemption | 0910-0078 |
| 860, subpart D | De Novo classification process | 0910-0844 |
| “Requests for Feedback on Medical Device Submissions: The Pre-Submission Program and Meetings with Food and Drug Administration Staff” | Q-submissions | 0910-0756 |
| 800, 801, and 809 | Medical Device Labeling Regulations | 0910-0485 |
| 820 | Current Good Manufacturing Practice (CGMP); Quality System (QS) Regulation | 0910-0073 |
Dated: April 5, 2022.
Lauren K. Roth,
Associate Commissioner for Policy.
1. Content of Premarket Submissions for Management of Cybersecurity in Medical Devices—Guidance for Industry and Food and Drug Administration Staff at https://www.fda.gov/regulatory-information/search-fda-guidance-documents/content-premarket-submissions-management-cybersecurity-medical-devices-0.
Back to Citation[FR Doc. 2022-07614 Filed 4-7-22; 8:45 am]
BILLING CODE 4164-01-P
101,973 comments have been received at Regulations.gov.
Agencies review all submissions and may choose to redact, or withhold, certain submissions (or portions thereof). Submitted comments may not be available to be read until the agency has approved them.