Medical device cybersecurity
Defense and government contractors handling medical devices face a tightening compliance knot: the U.S. Food and Drug Administration's 2023 cybersecurity requirements under Section 524B of the FD&C Act now mandate premarket submission of software bills of materials and ongoing vulnerability disclosure, while the Defense Contract Management Agency enforces CMMC 2.0 controls that directly intersect with networked medical device environments on DoD contracts. The Department of Homeland Security's Cybersecurity and Infrastructure Security Agency has separately issued binding operational directives that apply to federal agencies running medical device infrastructure, pulling contractors into scope through their system access obligations. Compliance teams are currently cross-mapping FDA software documentation requirements against CMMC Level 2 controls to close the overlap before contract renewal cycles.
Watch
- FDA Section 524B enforcement: premarket cyber submissions now required for most connected devices
- CMMC 2.0 Level 2 certification deadlines affecting DoD contractors with medical device interfaces
- CISA BOD 23-01 asset visibility requirements and whether your device access puts you in scope
- FDA's refusal-to-accept policy for submissions missing a software bill of materials
Recent material activity in Defense & Government Contracting
Active monitoring in place across Defense & Government Contracting. Material developments related to medical device cybersecurity will appear here as they are published.