United StatesFederal Food, Drug, and Cosmetic Act section 524B: cybersecurity requirements for cyber devices
Federal Food, Drug, and Cosmetic Act section 524B, 21 U.S.C. 360n-2
In force since .
A product security requirements rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security, Disclosure
As of .
What it requires
- It reaches you only if you are the sponsor of an application or submission for a device under section 360(k), 360c, 360e(c), 360e(f) or 360j(m) of title 21 (the Food and Drug Administration reads these as a 510(k), De Novo, premarket approval, product development protocol or humanitarian device exemption submission), and the device is a cyber device: a device that includes software validated, installed, or authorized by the sponsor as a device or in a device, has the ability to connect to the internet, and contains any such technological characteristics validated, installed, or authorized by the sponsor that could be vulnerable to cybersecurity threats (section 524B(a) and (c)).
- Include in the submission such information as the Secretary may require to ensure that the cyber device meets the cybersecurity requirements of section 524B(b) (section 524B(a)).
- Submit to the Secretary a plan to monitor, identify, and address, as appropriate, in a reasonable time, postmarket cybersecurity vulnerabilities and exploits, including coordinated vulnerability disclosure and related procedures (section 524B(b)(1)).
- Design, develop, and maintain processes and procedures to provide a reasonable assurance that the device and related systems are cybersecure, and make available postmarket updates and patches to the device and related systems that address known unacceptable vulnerabilities on a reasonably justified regular cycle and critical vulnerabilities that could cause uncontrolled risks as soon as possible out of cycle (section 524B(b)(2), (A) and (B)).
- Provide to the Secretary a software bill of materials, including commercial, open-source, and off-the-shelf software components (section 524B(b)(3)).
- Comply with such other requirements as the Secretary may require through regulation to demonstrate reasonable assurance that the device and related systems are cybersecure (section 524B(b)(4)).
- A device, or a category or type of device, that the Secretary has identified as exempt is not subject to these requirements (section 524B(d)).
These lines are LexLint's reading of the law's text, as of . Also read by: The Food and Drug Administration, Center for Devices and Radiological Health and Center for Biologics Evaluation and Research, guidance Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions, issued (guidance, recorded ).
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Section 333(a) of title 21 punishes a violation of section 331 with imprisonment of not more than one year or a fine of not more than $1,000, or both, and, after a final conviction or with intent to defraud or mislead, with imprisonment of not more than three years or a fine of not more than $10,000, or both.
Penalty structure
The civil penalty under 21 U.S.C. 333(f)(1)(A) for a violation of a requirement related to devices. The figures are the maximum adjusted penalties for 2024 printed in 45 CFR 102.3, Table 1, in the edition revised as of , the latest adjustment that edition carries.
- Rule
- Per violation only
- As of
- Currency
- USD
- Fixed cap
- 2,304,629
- Per violation unit
- Violation
- Per violation amount
- 34,568
Who enforces it
Enforcement body
The Food and Drug Administration, the agency that 45 CFR 102.3 lists for the civil penalty for a violation of a requirement related to devices.
Settledness
The guidance states that it represents the current thinking of the Food and Drug Administration and is not binding on the Administration or the public.
- As of
- Guidance link
- https://www.fda.gov/regulatory-information/search-fda-guidance-documents/cybersecurity-medical-devices-quality-system-considerations-and-content-premarket-submissions
- Guidance body
- The Food and Drug Administration, Center for Devices and Radiological Health and Center for Biologics Evaluation and Research, guidance Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions, issued
- Open questions
- Does a device that its sponsor does not intend to connect to the internet, but that carries a radio or hardware connector able to reach it, have the ability to connect to the internet under section 524B(c)(2), as the Food and Drug Administration reads that phrase to include a device able to connect intentionally or unintentionally through any means?
What this law does
Section 524B(a) requires a person who submits an application or submission under section 360(k), 360c, 360e(c), 360e(f), or 360j(m) of title 21 for a device that meets the definition of a cyber device to include such information as the Secretary may require to ensure that the cyber device meets the cybersecurity requirements of subsection (b).
Section 524B(c) defines a cyber device as a device that includes software validated, installed, or authorized by the sponsor as a device or in a device, has the ability to connect to the internet, and contains any such technological characteristics validated, installed, or authorized by the sponsor that could be vulnerable to cybersecurity threats.
Section 524B(b)(1) requires the sponsor to submit to the Secretary a plan to monitor, identify, and address, as appropriate, in a reasonable time, postmarket cybersecurity vulnerabilities and exploits, including coordinated vulnerability disclosure and related procedures. Section 524B(b)(2) requires the sponsor to design, develop, and maintain processes and procedures to provide a reasonable assurance that the device and related systems are cybersecure.
Section 524B(b)(2)(A) requires the sponsor to make available postmarket updates and patches to the device and related systems to address known unacceptable vulnerabilities on a reasonably justified regular cycle. Section 524B(b)(2)(B) requires the sponsor to make available postmarket updates and patches to address critical vulnerabilities that could cause uncontrolled risks as soon as possible out of cycle.
Section 524B(b)(3) requires the sponsor to provide to the Secretary a software bill of materials, including commercial, open-source, and off-the-shelf software components. Section 524B(b)(4) requires the sponsor to comply with such other requirements as the Secretary may require through regulation to demonstrate reasonable assurance that the device and related systems are cybersecure.
Section 524B(d) lets the Secretary identify devices, or categories or types of devices, that are exempt from the cybersecurity requirements established by the section and regulations promulgated under it. Section 3305(d) of Public Law 117-328 provides that the amendments adding section 524B take effect 90 days after the date of enactment, .
Section 3305(d) also provides that an application or submission submitted before that effective date is not subject to the requirements of section 524B(a) or (b). The Food and Drug Administration states that section 524B(a) applies to premarket submissions for cyber devices effective . Section 331(q)(3) of title 21 makes the failure to comply with any requirement under section 524B(b)(2) a prohibited act.
Section 333(a)(1) of title 21 provides that a person who violates a provision of section 331 is to be imprisoned for not more than one year or fined not more than $1,000, or both. Section 333(a)(2) raises that to imprisonment for not more than three years or a fine of not more than $10,000, or both, for a violation committed after a final conviction or with the intent to defraud or mislead.
Section 333(f)(1)(A) of title 21 makes a person who violates a requirement of the Act that relates to devices liable to the United States for a civil penalty of not more than $15,000 for each violation and not more than $1,000,000 for all violations adjudicated in a single proceeding.
Section 102.3 of title 45 of the Code of Federal Regulations, in the edition revised as of , lists the 2024 maximum adjusted penalty for that provision as $34,568 for each violation and $2,304,629 for all violations related to devices in a single proceeding. Except as provided in subsection (b) of that section, all proceedings for the enforcement of the Act, or to restrain violations of it, are by and in the name of the United States.
The Food and Drug Administration has issued guidance that addresses its recommendations regarding section 524B for cyber devices. That guidance states that it does not establish any rights for any person and is not binding on FDA or the public.
When LexLint raises it
When your app profile says your app distributes a software product or ships a mobile app.