Firmware

For FDA, firmware is software, so it needs the same documentation, cybersecurity controls and SBOM entries. Firmware updates are a common route for security patches.

software program or set of instructions programmed on the flash read-only memory (ROM) of a hardware device. It provides the necessary instructions for how the device communicates with the other computer hardware.

FDA guidance: Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026), Appendix 5, Terminology