Ophthalmic device cybersecurity that holds up at FDA
Surgical lasers, diagnostic systems and connected eye-care apps each get flagged for different reasons. We know which, and we close them before you file.
Where attackers get in
Five ways in, from the hospital network to the cloud.
Hospital network and imaging linksExam data moving to EHR and image management
Operator workstationThe PC or console, often Windows-based
USB and service accessRemovable media, maintenance and updates
Embedded controllerThe system that drives the laser or instrument
Cloud and appsAPIs, accounts and prescriptions for connected and home-use devices
Where ophthalmic cybersecurity gets hard
Capital equipment on old operating systems
Lasers and diagnostic platforms often run unpatched or end-of-life software. FDA rates that high risk, not medium.
Detection, not just lockout
FDA expects devices to detect, log and act on security events. A login lockout doesn't count.
Test findings you can't accept
Penetration test findings have to be fixed and retested, including the mediums.
Security fixes are software changes
Patches made to satisfy FDA need a change summary, impact analysis and new test evidence.
What FDA asks for, by device type
Surgical laser
Capital equipment
- Patch or replace end-of-life OS and libraries
- Add event detection and logging
- Fix and retest all pentest findings
- Document every security-driven software change
Digital vision test
SaMD
- Show the static analysis tools used and what they catch
- Put cybersecurity instructions in patient and clinician labeling
- Explain how authentication is enforced
Connected eye-care device
Home use + cloud
- Describe the APIs and manufacturer-built cloud services
- Explain which cloud security services you rely on
- Plan incident response, including what happens to therapy if cloud services go down
We've sat on FDA's side of the table.
Our team includes former FDA reviewers. We read your submission the way they will, before they do.
- We know what each FDA review division asks for.
- Experience with ophthalmic surgical, diagnostic and home-use devices.
- We typically turn around a full response to FDA cybersecurity questions in about 10 days.
How Medcrypt helps
Submission readiness
Close the 524B gaps FDA flags.
Clear FDA reviewLegacy software plan
SBOM, end-of-life tracking and a patch strategy FDA will accept.
SBOM managementAnswering FDA
Turn deficiency letters into accepted responses.
Services overview
We've supported ophthalmic manufacturers across surgical lasers, digital vision testing and connected eye-care devices.
How an engagement works
- 1
Gap check
Know where your ophthalmic device submission stands, starting with a 1‑hour review.
- 2
Build the evidence
Threat model, SBOM, architecture views and testing, sized to your device.
- 3
Reviewer check
Former FDA reviewers go through the package before you file.
- 4
After you file
If FDA sends questions, we typically turn around a full cybersecurity response in about 10 days.
A quick self-check for ophthalmic teams
Is every OS and library on your device still supported?
Can your device detect and log a security event, not just block a login?
Did you fix and retest every pentest finding, mediums included?
Does your labeling tell clinicians and patients what they need to do?
If your cloud goes down, do you know what happens to treatment?
Standards we work to
- FDA premarket cybersecurity guidancewhat reviewers check
- Section 524Bthe law for cyber devices
- ISO 14971safety risk management
- IEC 62304software lifecycle
- IEC 81001-5-1secure development
- AAMI TIR57security risk management
FAQ
Section 524B applies to cyber devices: devices that include software validated, installed, or authorized by the manufacturer, have the ability to connect to the internet, and could be vulnerable to cybersecurity threats. The test is whether the device is capable of connecting, not only whether its intended use involves connecting. That includes devices that connect only through a USB port.
Not automatically. FDA has rejected medium ratings for unpatched operating systems and expects test findings to be fixed and retested.
No. FDA treats SBOM monitoring as postmarket management. You still need controls like event detection built into the device.