Medical device
security compliance roadmap

If it contains software and can connect to the internet, it most likely is.

• ·What matters is not whether it connects today, but whether it can connect.
• ·If it pairs with an app over Bluetooth and the app uploads to the cloud, it counts as connected.
• ·If you're unsure, you can ask the FDA in advance (Q-Submission).

You need to show in writing that “we built it securely, and we'll keep it secure after launch.”

• ·The law requires three things: a post-market response plan, secure development and patching processes, and an SBOM
• ·In practice, the submission is split into 8 documents, including threat analysis, risk assessment and security test results.
• ·For the full list, see the original FDA guidance (PDF) ↗

An SBOM is your product's “software ingredients list” — without one, the FDA won't even accept your submission.

• ·It must list every component name and version, in a standard format (SPDX, CycloneDX).
• ·For outsourced firmware without source code, you have to analyze the finished binary itself to find its components.
• ·After launch, you need to check and patch whenever new vulnerabilities emerge, so you need an automated management system.

They're being aligned with the FDA's level, and the checklist has grown from 15 to 35 items.

• ·They cover basic security items such as authentication, passwords, updates and encryption — largely the same as the FDA's.
• ·For any item you mark “not applicable,” you must provide the rationale.
• ·SBOMs aren't mandatory in Korea yet, but if you plan to export, it's more efficient to prepare one in advance.

Guidelines (Korean) · National Institute of Food and Drug Safety Evaluation ↗

It isn't spelled out in law, but in practice it's almost essential.

• ·Penetration testing is on the FDA's list of tests to include in a submission.
• ·The report must state how independent the testers are from the development team.
• ·It's also recommended to repeat it regularly after launch (e.g., once a year).