US FDA Cybersecurity Watch for Connected Medical Devices: July 2025

Cybersecurity remains a central review topic for connected medical devices, including devices with software, wireless communication, cloud connectivity, or remote update functions. The regulatory expectation is to show that cybersecurity is managed throughout the product life cycle.

What to assess

• A traceable threat-model and risk-management file linked to device architecture and controls.
• Software bill of materials, vulnerability monitoring, and coordinated disclosure procedures.
• Verification evidence for authentication, access control, data protection, update mechanisms, and recovery.

Practical impact

Cybersecurity documentation should not be assembled only at submission. Teams should connect product development, quality, and post-market processes so that emerging vulnerabilities can be assessed and addressed after launch.

Source to monitor

Review the FDA medical device cybersecurity resources when planning a premarket submission or post-market process.