Blog
Notes on FDA, EU MDR and UK cybersecurity expectations for medical devices, written for QA/RA and software leads.
Recently a manufacturer received an AINN request asking for VEX and VDR data alongside their CycloneDX SBOM. This isn't in the premarket guidance, but you're almost certainly already doing the work. You just aren't packaging it in the format the FDA now wants.
Alan ParkinsonThe EU Cyber Resilience Act (CRA) excludes medical devices under MDR. But health apps, wellness products, and companion apps without medical device claims? They're in scope. If you're using the 'launch as wellness first' strategy, cybersecurity regulation still applies from December 2027
Alan ParkinsonAn SBOM (Software Bill of Materials) is essentially an ingredients list for software. Just like checking food labels for allergens, an SBOM lets you scan for known cybersecurity vulnerabilities in your product's third-party components.
Alan ParkinsonAlan ParkinsonKitware has added experimental SBOM generation to CMake. If you build embedded medical device software in C or C++, the build system you probably already use can now describe what goes into your firmware.
Alan ParkinsonAt the end of July, CISA published the 2026 Minimum Elements for a Software Bill of Materials, replacing the 2021 NTIA minimum elements reference by FDA Cybersecurity guidance since 2023. We take a look at the impact for medical device manufacturers.
Alan ParkinsonYou've maintained a SOUP list under IEC 62304 for years, and now the FDA or a hospital customer wants an SBOM. Isn't that the same document with a new name? Not quite. One is a safety classification, the other is a machine-readable inventory, and each does something the other can't. Here's how they fit together, and why your SBOM is the easiest way to keep your SOUP records honest.
Alan ParkinsonIs a medical device with a USB port really a "Cyber Device" and requires all the cybersecurity documentation in an eSTAR? We look at the guidance and some useful tips.
Alan ParkinsonIt's one of the most common objections I hear from founders, and once you see what an SBOM actually contains, it's a much smaller worry than it first appears. Here's what it does and doesn't expose, why submitting it isn't the same as publishing it, and why the list of libraries you used was never the secret worth protecting
Newsletter
Practical cybersecurity regulatory insights and guides for medical device teams. Free, no spam, unsubscribe anytime.
