Disposal

In FDA's cybersecurity guidance, disposal is part of the device lifecycle. Devices can hold patient data, credentials or keys, so manufacturers are expected to think about how these are removed when a device is retired.

a process to end the existence of a system asset or system for a specified intended use, appropriately handle replaced or retired assets, and to properly attend to identified critical disposal needs (e.g., per an agreement, per organizational policy, or for environmental, legal, safety, or security aspects).

FDA guidance: Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026), Appendix 5, Terminology