Threat modeling

FDA expects threat models in premarket cybersecurity documentation, covering the whole system and not only the device. They should be updated when the design, its environment or the threat picture changes.

Threat modeling is a methodology for optimizing Network/Application/Internet Security by identifying objectives and vulnerabilities, and then defining countermeasures to prevent, or mitigate the effects of, threats to the system. For medical devices, threat modeling can be used to strengthen security by identifying vulnerabilities and threats to a particular product, products in a product line, or from the organization’s supply chain that can cause patient harm.

FDA guidance: Postmarket Management of Cybersecurity in Medical Devices (December 2016), Section IV.I, Definitions

a methodology for optimizing system, product, network, application, and connection security by identifying objectives and vulnerabilities, and then defining countermeasures to prevent, or mitigate the effects of, threats to the system.

FDA guidance: Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026), Appendix 5, Terminology

The postmarket guidance adds a medical device context, noting that threat modeling can identify vulnerabilities and threats to a product, a product line or the supply chain that can cause patient harm. The premarket guidance gives the general definition only.