Compensating controls

Manufacturers may recommend compensating controls, such as network segmentation, while a fix is developed. They should not replace security that belongs in the device design.

a safeguard or countermeasure deployed, in lieu of, or in the absence of controls designed in by a device manufacturer. These controls are external to the device design, configurable in the field, employed by a user, and provide supplementary or comparable cyber protection for a medical device.

FDA guidance: Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026), Appendix 5, Terminology

A cybersecurity compensating control is a safeguard or countermeasure deployed, in lieu of, or in the absence of controls designed in by a device manufacturer. These controls are external to the device design, configurable in the field, employed by a user, and provide supplementary or comparable cyber protection for a medical device. For example, a manufacturer’s assessment of a cybersecurity vulnerability determines that unauthorized access to a networked medical device will most likely impact the device’s safety or essential performance. However, the manufacturer determines that the device can safely and effectively operate without access to the host network, in this case the hospital network. The manufacturer instructs users to configure the network to remove the ability of unauthorized/unintended access to the device from the hospital network. This type of counter measure is an example of a compensating control.

FDA guidance: Postmarket Management of Cybersecurity in Medical Devices (December 2016), Section IV.A, Definitions