It’s the Risk, Stupid: FDA Medical Device Guidance Looks Past the Device

The FDA issued final postmarket cybersecurity guidance for medical devices, urging manufacturers to monitor, identify, and remediate vulnerabilities and attacks; adopt comprehensive cybersecurity risk management programs, coordinated vulnerability disclosure policies, and participate in information-sharing organizations, while shifting emphasis from device-level protections to an outcomes-based approach.