Medical devices · November 2026
Connected medical devices: cybersecurity as a market-access requirement
For a manufacturer, cybersecurity is no longer an after-sales topic: it conditions CE marking as well as access to the US market.
A regulatory requirement
The MDR requires software and connected-device security to be addressed in design and risk management. The FDA, for its part, expects specific elements in submissions for “cyber devices”, including a software bill of materials (SBOM) and a vulnerability management plan.
The building blocks
- Threat modelling from the earliest design stage.
- Secure software lifecycle (IEC 81001-5-1) and third-party component management.
- Security testing: code analysis, penetration tests, tests of wireless interfaces such as Bluetooth Low Energy.
- Post-market monitoring: vulnerability watch, patches, communication to users.
Our view
Manufacturers that build these requirements into their quality system from the start avoid costly rework at certification time.
General information, not legal advice.