Software as a Medical Device: Understanding, Regulations, and Security Priorities
How FDA defines and regulates SaMD, and what to prioritize in a SaMD security strategy.
Read articleSaMD cybersecurity that holds up in FDA review
FDA considers Software as a Medical Device a cyber device, whether it runs as a mobile app, in the cloud or as an AI-driven algorithm. Medcrypt helps SaMD teams close the gaps FDA reviewers flag.
Where SaMD cybersecurity gets hard
- Cloud security is still your job
- Testing across the lifecycle
- Scoping that leaves things out
- SBOMs and continuous patching
Where SaMD cybersecurity gets hard
Cloud security is still your job
Cloud providers offer security tools, but configuring and maintaining a secure environment stays with the SaMD developer. FDA frequently identifies deficiencies in how cloud environments are secured.
Testing across the lifecycle
FDA reviews highlight missing security testing: static and dynamic code analysis, fuzz testing, vulnerability scanning and penetration testing.
Scoping that leaves things out
Common deficiencies include excluding relevant components and assuming the risks of interfaced devices are someone else's responsibility.
SBOMs and continuous patching
FDA mandates SBOMs for SaMD, documenting every software component. Continuous vulnerability monitoring and timely patching keep the device secure.
Where attackers get in
Cloud & APIsWhere the data and logic live
Web & mobile appsWhat users touch
Third-party componentsOpen source and SDKs
User dataPatient information in transit and at rest
How Medcrypt helps
SBOM and vulnerability management
Machine-readable SBOMs, vulnerabilities prioritized by exploitability, and FDA-ready SBOM, VEX and VDR exports.
SBOM managementPenetration testing support
Connect penetration testing to threat models, risk documentation, remediation and FDA submission evidence.
Penetration testingThreat modeling
Threat models drafted from your architecture and checked for submission readiness by former FDA reviewers.
Threat modelingSubmission readiness
Benchmark your cybersecurity evidence against FDA eSTAR review categories before filing and find the gaps.
Clear FDA review
How an engagement works
- 1
Gap check
Know where your SaMD submission stands, starting with a 1‑hour review.
- 2
Build the evidence
Threat model, SBOM, architecture views and testing, sized to your device.
- 3
Reviewer check
Former FDA reviewers go through the package before you file.
- 4
After you file
If FDA sends questions, we typically turn around a full cybersecurity response in about 10 days.
Further reading
Top Myths and Deficiencies of Software as a Medical Device (SaMD) Cybersecurity
Common SaMD cybersecurity myths and how they show up as deficiencies in FDA reviews.
Read articleStandards we work to
- FDA premarket cybersecurity guidancewhat reviewers check
- Section 524Bthe law for cyber devices
- ISO 14971safety risk management
- IEC 62304software lifecycle
- IEC 81001-5-1secure development
- AAMI TIR57security risk management
- IEC 82304-1health software products
FAQ
Section 524B applies to cyber devices: devices that include software validated, installed, or authorized by the manufacturer, have the ability to connect to the internet, and could be vulnerable to cybersecurity threats. The test is whether the device is capable of connecting, not only whether its intended use involves connecting. Because of the unique nature and high connectivity of SaMD, FDA considers SaMD to be cyber devices.
No. Cloud providers offer security tools, but the responsibility for configuring and maintaining secure environments lies with the SaMD developer. Best practices for cryptography, trusted communication and monitoring still apply, and FDA frequently identifies deficiencies in how cloud environments are secured.
A broad range of techniques: static and dynamic code analysis, fuzz testing, vulnerability scanning and penetration testing. FDA reviews highlight gaps in security testing and risk analysis, and regular audits and penetration testing find vulnerabilities before they can be exploited.