Remediation

Remediation can be a full fix, such as a patch, or compensating controls that users apply. Whether the risk was controlled or uncontrolled also affects whether the action has to be reported to FDA as a correction.

Remediation is any action(s) taken to reduce an uncontrolled risk of patient harm posed by a device cybersecurity vulnerability to an acceptable level. Remediation actions may include complete solutions to remove a cybersecurity vulnerability from a medical device or compensating controls that adequately mitigate the risk (e.g., notification to customers and the user community identifying a control the user can implement). An example of remediation is a notification to the customers and the user community that discloses the vulnerability, the impact to the device, the potential for patient harm, and provides a strategy to reduce the risk of patient harm to an acceptable and controlled level. If the customer notification does not provide a strategy to reduce the risk of patient harm to an acceptable and controlled level, then the remediation is considered incomplete.

FDA guidance: Postmarket Management of Cybersecurity in Medical Devices (December 2016), Section IV.G, Definitions