Controlled risk

The distinction between controlled and uncontrolled risk decides how FDA treats a cybersecurity fix. Changes for controlled risk can usually be handled as routine updates and patches.

Controlled risk is present when there is sufficiently low (acceptable) residual risk of patient harm due to a device’s particular cybersecurity vulnerability.

FDA guidance: Postmarket Management of Cybersecurity in Medical Devices (December 2016), Section IV.B, Definitions

when there is sufficiently low (acceptable) residual risk of patient harm due to a device’s particular cybersecurity vulnerability.

FDA guidance: Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026), Appendix 5, Terminology