SOP: Postmarket Cybersecurity Vulnerability Management and Coordinated Disclosure

This is a ready-to-use SOP for the postmarket half of section 524B: taking in vulnerability reports, deciding whether the risk is controlled or uncontrolled, and running the remediation and reporting clock that follows from that decision. Replace every <<FILL: ...>> placeholder with your own specifics. A filled specimen follows. Verify the current postmarket cybersecurity guidance and 21 CFR part 806 against their published versions before you rely on this SOP; it is educational structure to adapt, not legal or regulatory advice.

Document control header

1. Purpose

This procedure defines how <<FILL: COMPANY NAME>> receives, triages, remediates, and reports cybersecurity vulnerabilities affecting fielded cyber devices and combination-product device constituents, so that the postmarket plan committed to under section 524B of the FD&C Act is an operating program and not a document that exists only in the submission file.

2. Scope

This procedure applies to every cyber device and device constituent <<FILL: COMPANY NAME>> has on the market, whatever submission authorized it.

• Covers products whose primary application is a BLA, NDA, or IND, not only a standalone device marketing authorization.
• Covers vulnerabilities found internally (security testing, SBOM-driven composition analysis), reported by customers, or disclosed by external researchers.

3. Responsibilities

4. Definitions

• Controlled risk: the residual risk of patient harm, after existing compensating controls, is already at an acceptable level. A fix is a routine cybersecurity update or patch.
• Uncontrolled risk: the residual risk of patient harm is not acceptable, given the vulnerability’s exploitability and the severity of harm if exploited. Reportable under 21 CFR 806.10 by default.
• Coordinated vulnerability disclosure (CVD): a defined channel and process through which external security researchers can report a suspected vulnerability and receive acknowledgment and status updates.
• Information sharing and analysis organization (ISAO): a medical-device-sector threat-sharing body, for example H-ISAC, referenced in the enforcement-discretion conditions below.

5. Procedure

5.1 Intake

1. Maintain a published, monitored coordinated vulnerability disclosure channel (a security contact address, a disclosure policy page, or a bug-bounty intake) for <<FILL: product name(s)>>.
2. Log every report, internal finding, or SBOM-driven alert in the tracking system within <<FILL: number>> business days of receipt, with a unique identifier.
3. Acknowledge external reporters within <<FILL: number>> business days.

5.2 Triage: controlled or uncontrolled risk

1. Assess exploitability (access required, skill level, equipment needed) and the severity of harm if the vulnerability were exploited.
2. Determine whether, after existing compensating controls, the residual risk of patient harm is acceptable (controlled) or not acceptable (uncontrolled). Document the rationale.
3. For an uncontrolled-risk finding, immediately notify Regulatory Affairs and Quality Assurance per section 5.4.

5.3 Controlled-risk handling

1. Schedule the fix as a routine cybersecurity update or patch on the normal release cycle.
2. Document the controlled-risk rationale in the vulnerability record; no 21 CFR 806 report is generally required for this class of fix.

5.4 Uncontrolled-risk handling and the reporting decision

1. Open a record in the product’s CAPA or deviation system the same day the uncontrolled-risk determination is made; this runs in parallel with, not instead of, the security tracking record.
2. Confirm whether no known serious adverse events or deaths are associated with the vulnerability. If any are known, proceed directly to the 21 CFR 806.10 report; the enforcement-discretion path in step 4 does not apply.
3. Within 30 days of learning of the vulnerability, issue a customer / user-community communication describing the vulnerability, any interim compensating controls, and the remediation plan and timeline.
4. Develop, validate, and distribute a deployable fix that brings the residual risk to an acceptable level within 60 days of learning of the vulnerability. If the fix will not be ready in time, do not wait for the deadline to pass before acting: escalate to Regulatory Affairs so the 806.10 report can be prepared before the window closes.
5. Confirm active participation in an information sharing and analysis organization for medical devices and share the same customer communications with it.
6. If all of steps 2 through 5 are met on time, document that the enforcement-discretion conditions are satisfied and that no 21 CFR 806 report is being filed for this specific vulnerability. If any one condition is missed, file the correction report under 21 CFR 806.10 without waiting for the others to catch up.
7. For a constituent with PMA periodic-reporting status, include the vulnerability and its remediation in the next periodic (annual) report regardless of the 806 reporting outcome.

5.5 Closure

1. Confirm the fix is validated and deployed to the installed base, or that a documented, risk-accepted alternative is in place.
2. Close the CAPA/deviation record and the security tracking record together, cross-referenced.
3. Retain all records per <<FILL: retention period>>.

6. Acceptance criteria

• Every vulnerability, internal or externally reported, has a documented controlled/uncontrolled determination with a stated rationale.
• Every uncontrolled-risk finding has a CAPA or deviation record, not only a security-tool ticket.
• Where the enforcement-discretion path is used, all four conditions are documented as met, with dates, before concluding no 806 report is needed.
• Where any condition is missed, the 21 CFR 806.10 report is filed, and the record shows no attempt to retroactively claim the safe harbor.
• The coordinated disclosure channel is live, monitored, and acknowledges reports within the committed window.

7. Records generated

• Vulnerability intake and triage record (one per finding).
• Customer / user-community communication (dated, for each uncontrolled-risk finding).
• CAPA or deviation record (for each uncontrolled-risk finding).
• 21 CFR 806.10 correction report, where filed.
• ISAO communication log.

8. References

Section 524B, Federal Food, Drug, and Cosmetic Act. FDA guidance, Postmarket Management of Cybersecurity in Medical Devices (final, 2016). 21 CFR part 806, Medical Devices; Reports of Corrections and Removals (see 21 CFR 806.10). FDA guidance, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (current version; confirm the version in force).

Confirm the current version of each guidance and the exact clause numbers before issue.

9. Revision history

10. Approvals

Filled specimen

This specimen shows a finding that met the safe harbor on all four conditions.

• Every date is recorded against the day-count that actually matters: day 17 of 30 for the customer communication, day 57 of 60 for the fix.
• A finding that misses either window is filed under 21 CFR 806.10 instead; the record would look identical except for the fix-distribution date and the added report reference.

Common inspection findings this SOP prevents

• A coordinated vulnerability disclosure policy that exists on a web page but has no monitored intake behind it.
• An uncontrolled-risk vulnerability tracked only in a security ticketing system, with no corresponding CAPA or deviation record.
• A claimed enforcement-discretion safe harbor with no documented date for the customer communication or the fix distribution, so the 30-day and 60-day conditions cannot actually be verified.
• A fix that missed the 60-day window with no 21 CFR 806.10 report filed, because the team treated the safe harbor as automatic rather than conditional.
• No record of ISAO participation or of sharing the customer communication with it.

How to adapt this SOP

1. Set your document number, owner, and effective date in the header.
2. Point section 2 at your actual product list, including any device constituents of drug-led or biologic-led combination products.
3. Set the intake and acknowledgment timeframes in section 5.1 to match your actual coordinated disclosure commitment.
4. Confirm your ISAO membership (H-ISAC, MedTech ISAO, or an equivalent) and name it in section 5.4, step 5.
5. Link section 5.4, step 1 to your real CAPA or deviation procedure number.