Proposed changes to FDA guidance for the content of premarket submissions for management of cybersecurity in medical devices: What you should know

On October 18, 2018, FDA issued a long-awaited draft revision to its existing guidance "Content of Premarket Submissions for Management of Cybersecurity in Medical Devices"(premarket cybersecurity guidance). This coincided with release of the FDA-supported "Medical Device Cybersecurity Regional Incident Preparedness and Response Playbook" for health delivery organizations (HDOs), the announcement of two new Information Sharing Analysis Organizations (ISAOs), and FDA's recent news release discussing the agency's enhanced cybersecurity partnership with the U.S. Department of Homeland Security (DHS) earlier this month. Consistent with the U.S. Department of Health and Human Services - Office of Inspector General's September 2018 report "FDA Should Further Integrate Its Review of Cybersecurity Into the Premarket Review Process for Medical Devices," FDA's recent flurry of activity focuses on providing additional clarity about when to interact with FDA, what information would be useful in submissions, and what level of documentation is expected.