# FDA Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions

Framework id: `fda_cyber`. Medical Device Security. Publisher: U.S. Food and Drug Administration (FDA). Version: 2023. Region: USA. Mapping licence: CC BY-SA 4.0.
Source text: https://www.fda.gov/regulatory-information/search-fda-guidance-documents/cybersecurity-medical-devices-quality-system-considerations-and-content-premarket-submissions

Each line is a clause, the NIST SP 800-53 controls OSA maps to it, and OSA's estimate of how far those controls cover it.
Clause titles and coverage figures are OSA's own summaries and estimates. No line-by-line check against the source text is recorded for this framework, so quote the source, not this card.

## Clauses (42, average coverage 67%)
- 524B-1 Section 524B — Mandatory SBOM for Premarket Submissions: CM-08, SR-04, SR-05, SA-04, SA-10 (48%)
- 524B-2 Section 524B — Postmarket Vulnerability Monitoring Plan: RA-05, SI-02, SI-05, PM-04, PM-15, CA-07 (68%)
- 524B-3 Section 524B — Coordinated Vulnerability Disclosure Requirement: PM-15, IR-06, IR-07, SI-05 (50%)
- 524B-4 Section 524B — Reasonable Assurance of Cybersecurity: CA-02, CA-07, PM-01, PM-09, PL-02, SA-11, RA-03 (65%)
- CRA-1 Cybersecurity Risk Assessment — Exploitability Assessment: RA-03, RA-05, RA-10, CA-08, SA-11 (68%)
- CRA-2 Cybersecurity Risk Assessment — Patient Safety Impact: RA-03, RA-09, PM-09, PM-11 (45%)
- CRA-3 Cybersecurity Risk Assessment — Residual Risk Documentation: RA-03, RA-07, CA-05, PM-09, PL-02 (65%)
- CVD-1 Coordinated Vulnerability Disclosure — Policy and Process: PM-15, SI-05, IR-06, IR-07, PM-22 (55%)
- CVD-2 Coordinated Vulnerability Disclosure — CISA/ICS-CERT Coordination: IR-06, PM-15, SI-05 (50%)
- INC-1 Incident Response — Medical Device-Specific Response: IR-01, IR-02, IR-03, IR-04, IR-05, IR-06, IR-07, IR-08 (75%)
- INC-2 Incident Response — Safety-Focused Triage: IR-04, IR-05, RA-03, RA-07 (55%)
- INC-3 Incident Response — Medical Device Reporting (MDR) Obligations: IR-06, PM-04, SI-05 (40%)
- MON-1 Postmarket Monitoring — Cybersecurity Information Sources: SI-05, PM-15, PM-16, RA-05, SR-08 (78%)
- MON-2 Postmarket Monitoring — Vulnerability Identification and Assessment: RA-05, RA-03, RA-07, SI-02, SI-05 (72%)
- MON-3 Postmarket Monitoring — Threat Intelligence: PM-15, PM-16, RA-10, SI-04, SI-05 (78%)
- PU-1 Patching and Updates — Validated Software Updates: SI-02, CM-03, CM-04, SA-10, SA-11 (75%)
- PU-2 Patching and Updates — Patch Management for Device Software: SI-02, CM-02, CM-03, CM-06, SA-22 (70%)
- PU-3 Patching and Updates — Compensating Controls When Patches Unavailable: SI-02, SA-22, SC-07, SI-03, SI-04 (68%)
- SA-1 Security Architecture — Authentication and Authorisation: IA-01, IA-02, IA-03, IA-04, IA-05, IA-06, IA-07, IA-08, IA-09, IA-11, IA-12, AC-01, AC-02, AC-03, AC-06, AC-07, AC-14, AC-24 (88%)
- SA-2 Security Architecture — Cryptographic Controls: SC-08, SC-12, SC-13, SC-17, SC-23, SC-28 (88%)
- SA-3 Security Architecture — Code, Data, and Execution Integrity: SI-07, SI-16, SA-10, CM-02, CM-03, CM-05, SC-34 (82%)
- SA-4 Security Architecture — Confidentiality Protections: SC-04, SC-08, SC-28, AC-03, AC-04, AC-06, MP-02, MP-04, MP-06 (85%)
- SA-5 Security Architecture — Event Detection and Logging: AU-02, AU-03, AU-04, AU-05, AU-06, AU-08, AU-09, AU-12, SI-04, SI-06 (82%)
- SA-6 Security Architecture — Resilience and Recovery: CP-02, CP-09, CP-10, CP-11, CP-12, CP-13, SI-13, SI-17, SC-24 (78%)
- SBOM-1 Software Bill of Materials — Component Inventory: CM-08, SR-04, SR-05, SA-04, SA-10 (55%)
- SBOM-2 Software Bill of Materials — Machine-Readable Format and Maintenance: CM-08, SR-04, SA-10, SI-02 (42%)
- SBOM-3 Software Bill of Materials — Component-Level Vulnerability Tracking: RA-05, SR-04, SR-06, CM-08, SI-02, SI-05 (58%)
- SPDF-1 Secure Product Development Framework — Lifecycle Integration: SA-03, SA-08, SA-15, SA-17, PL-02, PL-08, PM-01, PM-07 (72%)
- SPDF-2 Secure Product Development Framework — Security Risk Management: RA-01, RA-02, RA-03, RA-07, RA-09, PM-09, PM-28, CA-02 (68%)
- SPDF-3 Secure Product Development Framework — Security Architecture Documentation: SA-17, SA-08, PL-02, PL-07, PL-08, SA-05, CM-06 (75%)
- ST-1 Security Testing — Static and Dynamic Analysis: SA-11, SA-15, SI-07, RA-05 (82%)
- ST-2 Security Testing — Penetration Testing: CA-08, SA-11, RA-05, RA-10 (80%)
- ST-3 Security Testing — Fuzz Testing and Robustness: SA-11, SI-10, RA-05 (72%)
- ST-4 Security Testing — Vulnerability Scanning and SCA: RA-05, SA-11, CM-08, SR-04, SR-05 (78%)
- TM-1 Threat Modelling — Threat Identification and Characterisation: RA-03, RA-05, RA-10, PM-12, PM-16, SA-11 (75%)
- TM-2 Threat Modelling — Attack Vectors and Trust Boundaries: RA-03, SA-08, SA-17, SC-07, AC-04 (70%)
- TM-3 Threat Modelling — Assumptions and Mitigations: RA-03, RA-07, PL-02, SA-08, PM-09 (72%)
- TR-1 Transparency — Cybersecurity Documentation for Users: SA-05, PL-02, PL-04, PM-20, PM-21 (60%)
- TR-2 Transparency — Residual Risk Communication: RA-03, RA-07, PM-09, SA-05 (55%)
- TR-3 Transparency — Compensating Controls Guidance: SA-05, SA-09, PL-02, PL-04 (52%)
- VR-1 Vulnerability Response — Controlled vs Uncontrolled Risk: RA-07, RA-03, IR-04, IR-05, PM-09 (58%)
- VR-2 Vulnerability Response — Remediation Timeline Expectations: SI-02, RA-07, CA-05, PM-04 (62%)

## More
- A pattern's controls with their clauses in this framework: /api/v1/patterns/{id}/crosswalk?framework=fda_cyber
- Control-to-clause mappings as JSON: /api/v1/frameworks/fda_cyber?fields=mappings&per_page=100
- Rationale and gaps for each clause, as JSON: https://raw.githubusercontent.com/opensecurityarchitecture/osa-data/main/data/framework-coverage/fda-cyber.json
- Page for people: /frameworks/fda-cyber/