Authentication

For a connected device, weak or shared authentication is a frequent source of vulnerabilities. FDA reviewers look for authentication that fits the risk of each interface, not one rule for every access point.

the act of verifying the identity of a user, process, or device as a prerequisite to allowing access to the device, its data, information, or systems, or provision of assurance that a claimed characteristic of an entity is correct.

FDA guidance: Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026), Appendix 5, Terminology