21 U.S.C. § 360n–2 — Ensuring cybersecurity of devices

(a) In general Anyone submitting certain device applications (under sections 360(k), 360c, 360e(c), 360e(f), or 360j(m)) for a device that counts as a "cyber device" must include whatever information the FDA requires to show the device meets the cybersecurity requirements in subsection (b). (b) Cybersecurity requirements The sponsor must: (1) submit a plan to reasonably monitor, find, and address cybersecurity vulnerabilities and exploits after the device is on the market, including a process for handling outside reports of vulnerabilities; (2) design and maintain processes giving reasonable assurance the device and its connected systems are secure, and provide updates and patches — on a regular, justified cycle for ordinary known vulnerabilities, and as fast as possible, outside the normal cycle, for critical vulnerabilities that could cause serious uncontrolled risks; (3) give the FDA a "software bill of materials" — a list of all commercial, open-source, and off-the-shelf software components in the device; and (4) meet any other requirements the FDA sets by regulation to reasonably assure the device and its systems are cybersecure. (c) Definition A "cyber device" is a device that: (1) includes software the sponsor validated, installed, or authorized as part of the device; (2) can connect to the internet; and (3) has technological features validated, installed, or authorized by the sponsor that could be vulnerable to cybersecurity threats. (d) Exemption The FDA can identify specific devices, or types of devices, that don't have to meet these cybersecurity requirements, and must publish (and keep updated) a list of these exempted devices in the Federal Register.