Cybersecurity evidence your notified body will accept
EU MDR makes cybersecurity part of the General Safety and Performance Requirements and requires state-of-the-art security. We map what you already have to what your notified body will ask for, then recommend how to close the gaps.
How we help
- Gap check
- Fill the gaps
- Notified body readiness
EU MDR cybersecurity requirements at a glance
There's no standalone cybersecurity regulation for devices in the EU. Instead, MDR Annex I makes it mandatory through the requirements below.
- GSPR 17.2
Software developed to the state of the art, including information security.
- GSPR 17.4
Manufacturers state minimum IT security requirements, including protection against unauthorized access.
- GSPR 18.8
Devices protected against unauthorized access that could stop them working as intended.
- GSPR 14.2(d)
Reduce risks from interaction between the device's software and its IT environment.
- MDCG 2019-16
Guidance for manufacturers and notified bodies on how to meet MDR's information security and safety requirements.
- IEC 81001-5-1
Commonly used to show state-of-the-art secure development processes.
- IEC 62304
Software lifecycle processes. Commonly used to meet MDR's software requirements, it calls for a list of SOUP (third-party software) components, best covered by a device SBOM.
- IVDR Annex I
Equivalent requirements for IVDs.
Where FDA-first teams get caught
The cybersecurity work you prepared for FDA can support your EU submission, but on its own it doesn't show you meet EU requirements. The differences affect who reviews your evidence, what you tell customers and how you manage security after launch. Sometimes it's as simple as renaming a document; other changes are more involved. We help you adapt the work you have rather than start again.
Hover over a heading, or select it to read more.
Proof
"Medcrypt's structured approach to document review was very helpful. We liked their guidance and enjoyed working with their team."
FAQ
Not as a separate law. Cybersecurity sits inside MDR Annex I (17.2, 17.4 and 18.8), with MDCG 2019-16 as guidance.
For most devices, your notified body reviews it as part of the technical documentation. Self-certified Class I devices don't go to a notified body, but the same Annex I requirements still apply.
Much of it, yes. Your threat model, risk assessment, test reports and SBOM carry over, but they need to be mapped to the GSPRs and MDCG 2019-16. Your postmarket plan also has to align with EU vigilance and post-market surveillance, and the IFU security section usually needs work.
No. Devices regulated under MDR or IVDR are excluded from the Cyber Resilience Act. However, non-regulated components, such as network or server and cloud infrastructure, may fall under the CRA.
IEC 81001-5-1 is the most common reference for the secure development lifecycle. Your notified body may ask for others.