Uncontrolled risk

In FDA's postmarket cybersecurity approach, the split between controlled and uncontrolled risk decides how urgently a vulnerability has to be handled and whether the fix is reported to FDA. The judgment looks at patient harm, not only at the technical severity of the vulnerability.

Uncontrolled risk is present when there is unacceptable residual risk of patient harm due to inadequate compensating controls and risk mitigations.

FDA guidance: Postmarket Management of Cybersecurity in Medical Devices (December 2016), Section IV.J, Definitions

when there is unacceptable residual risk of patient harm due to inadequate compensating controls and risk mitigations.

FDA guidance: Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026), Appendix 5, Terminology