Attack surface analysis

FDA expects device cybersecurity documentation to show where an attacker could reach the device. The analysis guides which security controls and tests are needed, and it should be updated when interfaces change.

evaluation of attack surface to determine all avenues of ingress and egress to and from a system including common vulnerabilities and exposed ports and services.

FDA guidance: Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026), Appendix 5, Terminology