Security risk management

It runs alongside safety risk management under ISO 14971 but uses exploitability rather than probability, because attacks are not random events. Its outputs feed the safety risk file whenever an exploit could lead to patient harm.

a process (or processes) that evaluates and controls threat-based risks. For security risk management, this includes an evaluation of the impact of exploitation on the device’s safety and effectiveness, the exploitability, and the severity of patient harm if exploited.

FDA guidance: Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026), Appendix 5, Terminology