Secure product development framework (SPDF)

FDA expects manufacturers to show that security is built in across the product life cycle, from design and risk management to testing and updates. An existing framework can be used if it is integrated into the quality system rather than run as a separate effort.

a set of processes that reduce the number and severity of vulnerabilities in products. Additional information about an SPDF and its implementation is discussed in Sections IV and V, and throughout the guidance.

FDA guidance: Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026), Appendix 5, Terminology