Coordinated Vulnerability Disclosure in Medical Device Manufacturing

The voluntary disclosure of cybersecurity vulnerabilities in medical devices is an evolving necessity driven by increasing cyberthreats. Many countries follow World Health Organization (WHO) guidelines on post-market surveillance, vulnerability disclosure for medical devices, and mandatory reporting of any adverse events related to devices in use, though implementation varies.¹ The US Food and Drug Administration (FDA) also plays a central role in ensuring the cybersecurity of medical devices. A key global regulator, the FDA’s principles can be applied globally. Global medical device manufacturers can adapt the practices to their respective regulatory bodies (e.g., Australia’s Therapeutic Goods Administration [TGA], the EU Medical Device Regulation [MDR], Japan’s Pharmaceuticals and Medical Devices Agency [PMDA]) based on their market requirements.

In January 2025, the FDA highlighted vulnerabilities in specific patient monitors that could permit unauthorized access and manipulation.² Although well-documented incidents of exploited vulnerabilities in Class II medical devices are not common, the FDA has acknowledged the potential risk.

Class II medical devices, as defined by the FDA, are moderate- to high-risk devices requiring special controls (e.g., labeling, performance standards) to ensure their safety and effectiveness. These devices include infusion pumps, diagnostic monitors, and certain surgical tools.³ The US Federal Bureau of Investigation (FBI) reported in 2022 that 53% of connected medical devices (many of them Class II) in hospitals had critical vulnerabilities.⁴ For example, a Class II recall involving cybersecurity vulnerabilities was related to the unauthorized control of insulin delivery via an insulin pump.⁵

Since 2023, the FDA has intensified its focus on cybersecurity for medical devices, especially with the enactment of Section 524B of the US Food, Drug, and Cosmetic (FD&C) Act (via the 2022 Consolidated Appropriations Act). This provision mandates cybersecurity requirements for “cyber devices” (those with software, internet connectivity, and sponsor-validated technological characteristics with potential vulnerabilities), which include many Class II devices.⁶

As connected medical devices become integral to patient care, cybersecurity vulnerabilities threaten safety, data integrity, and healthcare continuity. Leading regulators—including the FDA, Health Canada, EU MDR, and others—increasingly require or strongly encourage manufacturers to adopt coordinated vulnerability disclosure (CVD) practices, alongside mandatory post-market surveillance and incident reporting. Examining global regulatory approaches reveals best practices essential for safeguarding patient health and maintaining trust in digital healthcare systems:

1. Implement a risk management program. Develop a structured program to monitor, identify, and address cybersecurity vulnerabilities.
2. Participate in information sharing analysis organizations (ISAOs). Collaborate with ISAOs to share and receive information about potential vulnerabilities and emerging threats.⁷
3. Apply the US National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) 2.0. Utilize the core principles of Govern, Identify, Protect, Detect, Respond, and Recover to manage cybersecurity risk.⁸

What Is Coordinated Vulnerability Disclosure?

Per the European Union Agency for Cybersecurity (ENISA), CVD is a process designed to ensure that vulnerabilities are publicly revealed only once the responsible entities have developed a fix, a patch, or offered mitigation measures to limit the potential threat of exploitation.⁹ While crucial for cybersecurity, it is important to emphasize that CVD is not universally mandated by law, and its implementation often relies on an enterprise's ethical commitment. However, a foundational ethical practice, even in the absence of formal CVD requirements, is risk reporting, which serves as a baseline for transparently communicating potential threats and exposures. Such disclosures can foster customer trust, enhance incident response coordination, and demonstrate adherence to best practices.

Though medical device manufacturers commonly adopt International Organization for Standardization (ISO)/International Electrotechnical Commission (IEC) 15408 as a cybersecurity baseline, this framework falls short of addressing the proactive vulnerability disclosure and mandatory reporting obligations demanded by regulators.¹⁰ However, the FDA’s guidance on CVD aligns with industry standards such as ISO/IEC 29147 and ISO/IEC 30111, which help manufacturers balance security, compliance, and patient safety.¹¹ ISO/IEC 29147 offers an internationally recognized framework for vulnerability disclosure, emphasizing coordinated vulnerability management between vendors and users.¹² In medical device manufacturing, adherence to this standard can ensure that hospitals, healthcare centers, and patients are informed about cybersecurity risk associated with medical equipment. Yet the practical implementation and extent of these disclosures remain variable. By voluntarily disclosing vulnerabilities and implementing timely mitigation, manufacturers contribute to the overall safety and security of medical devices.

The Regulatory Landscape: FDA Compliance and Cybersecurity

The FDA’s premarket and postmarket cybersecurity guidance underscores the need for manufacturers to assess vulnerabilities and communicate risk effectively.¹³ Furthermore, the FDA’s 2023 cybersecurity requirements for medical devices under the Food and Drug Omnibus Reform Act (FDORA) mandate cybersecurity risk management plans, timely patches, and security disclosures.¹⁴ Despite these requirements, cybersecurity disclosure practices in the medical device industry are inconsistent.¹⁵ Until harmonized standards emerge, these inconsistencies will continue to challenge patient safety and supply chain trust. Medical device manufacturers often evaluate cybersecurity risk internally, with limited transparency regarding their findings. This raises concerns about the adequacy of information provided to hospitals, healthcare providers, and insurance companies concerning cyberrisk that could affect patient safety.

FDA’s Role and Compliance

The FDA has progressively increased its emphasis on medical device cybersecurity.¹⁶ Although a mandatory disclosure rule does not exist, the FDA’s expectations and requirements strongly promote transparency through:

• Premarket submissions—Manufacturers of cyberdevices must submit plans to monitor, identify, and address potential postmarket cybersecurity vulnerabilities, including CVD procedures, and provide a software bill of materials (SBOM).¹⁷
• Postmarket guidance—The FDA’s guidance on postmarket cybersecurity management highlights the importance of ongoing monitoring and risk assessment and the timely communication of vulnerabilities and provision of patches.¹⁸
• Medical device reporting (MDR)—Manufacturers are required to report specific cybersecurity incidents that could lead to patient harm.¹⁹ Healthcare providers and device users can also voluntarily report cybersecurity issues through MedWatch.²⁰
• A tiered approach—The FDA divides software-driven medical devices into two categories: Tier 1 (higher risk, capable of connecting to other devices or networks, and potentially causing patient harm) and Tier 2 (lower risk). Tier 1 devices face more stringent cybersecurity expectations.²¹

Are Medical Device Manufacturers Practicing Voluntary Disclosure?

While some manufacturers have adopted voluntary disclosure and security advisories, others remain cautious about doing so due to concerns about reputational damage, liability, and regulatory consequences. This results in varying levels of transparency within the industry.

Key concerns include:

• Lack of standardized disclosure practices—There is no uniform standard for reporting medical device cybersecurity incidents.
• Limited public awareness—Hospitals and healthcare providers may not always receive timely vulnerability information, hindering mitigation efforts.
• Regulatory ambiguities—While encouraging transparency, FDA enforcement depends largely on self-reporting by manufacturers.

Compliance Factors in Cybersecurity

Prompt vulnerability identification and prioritized remediation are key in medical device cybersecurity. However, FDA regulations often prevent the immediate patching of vulnerabilities, demanding robust exception handling with documented compensating controls and long-term mitigation plans. Ethical disclosure requires cybersecurity professionals to act responsibly and report vulnerabilities to stakeholders and developers before public announcement, allowing time for fixes to be implemented and preventing exploitation. Manufacturers are advised to:

• Monitor cybersecurity information sources—Stay informed about new vulnerabilities and assess their impact on medical devices.
• Establish vulnerability handling processes—Define clear procedures for intake, assessment, and remediation of identified vulnerabilities.
• Communicate with stakeholders—Notify users and implement changes to reduce risk to an acceptable level within specified time frames.

These practices align with the FDA’s quality system regulation and demonstrate a commitment to maintaining device integrity.²²

Consequences of Failing to Disclose

Failure to voluntarily disclose cybersecurity vulnerabilities in medical devices can have any number of significant negative consequences:

• Patient safety risk—Undisclosed vulnerabilities can be exploited, leading to device malfunction, therapy manipulation, or unauthorized access to sensitive patient data, directly endangering patients by potentially compromising their safety.
• Delayed mitigation—Without disclosure, healthcare providers and device users are unaware of potential risk and cannot implement timely precautions, increasing their vulnerability.
• Erosion of trust—Lack of transparency can damage trust among manufacturers, healthcare providers, and patients, potentially harming a manufacturer’s reputation and hindering device adoption.
• Regulatory scrutiny and liability—Failure to adequately address and communicate known vulnerabilities could lead to increased FDA scrutiny, recalls, and legal liability if patient harm occurs.
• Impact on healthcare organizations—Hospitals and healthcare centers rely on accurate device security information for network security and patient protection. Lack of disclosure hinders effective risk assessments and safeguards. Inconsistent reporting and lack of contractual governance would leave hospitals with limited control over data collection or patch deployment. Without enforceable terms to audit device data flows or apply critical updates, healthcare systems remain exposed to cybersecurity risk, thus demanding stronger vendor accountability and standardized regulatory oversight.
• Insurance industry implications—Lack of transparency complicates risk assessment and management for insurance providers facing an increased risk of healthcare data breaches and liability for compromised devices.
• Operational disruptions—Cyberattacks on networked medical devices can disrupt healthcare services, causing financial and reputational damage.
• Reputational damage—Manufacturers may experience a loss of trust and credibility among healthcare providers and patients.

The increasing complexity of cybersecurity threats highlights the importance of voluntary disclosure, especially in safety-critical industries. Although the FDA sets expectations for cybersecurity transparency in medical device manufacturing, particularly for Class II devices, the level of scrutiny and transparency can differ compared to Class I or Class III devices due to varying risk profiles.

Current State of Cybersecurity Disclosure in Medical Devices

Voluntary disclosure is happening, but it varies. While it is not always formally termed "voluntary disclosure," medical device manufacturers engage in several forms of communication aligning with its principles:

• Postmarket vulnerability management—The FDA mandates that manufacturers have plans in place to monitor, identify, and address postmarket cybersecurity vulnerabilities. This often involves communicating identified risk and mitigation measures such as software updates to healthcare providers and device users.
• Coordinated vulnerability disclosure—The FDA encourages the implementation of CVD processes for receiving and addressing vulnerability reports from security researchers and others. By necessity, this involves communication and disclosure. ISO/IEC 29147 provides guidance for these processes.
• Software bill of materials—The FDA now requires SBOMs for cyberdevices in premarket submissions. Supplying SBOM information to healthcare providers can enhance transparency about device software components and potential vulnerabilities. The US Government Accountability Office (GAO) has noted challenges in cybersecurity compliance, including inconsistent adoption of SBOM and CVD processes among Class II manufacturers.²³
• Security features in labeling—Manufacturers often include security feature information in user manuals and labeling.
• Manufacturer Disclosure Statement for Medical Device Security (MDS2)—Though voluntary, the MDS2 form, developed by the US National Electrical Manufacturers Association (NEMA) and the Medical Imaging and Technology Alliance (MITA), offers a structured way for manufacturers to communicate security-related information to healthcare organizations.²⁴ Although the MDS2 is not required by law, it is recommended by the FDA, the IEC, and the Association for the Advancement of Medical Instrumentation (AAMI).²⁵

Consequences of the Lack of Disclosure

Specific, publicly detailed cases linking patient harm directly to a lack of voluntary disclosure are difficult to ascertain due to legal and proprietary sensitivities. However, cybersecurity vulnerabilities affecting numerous medical devices underscore the importance of transparency:

• Insulin pumps—Researchers have discovered vulnerabilities that could allow unauthorized individuals to change dosage settings.²⁶ The FDA is aware of manufacturers illegally marketing unauthorized devices for diabetes management, which have not been reviewed by the agency for safety and effectiveness.
• Pacemakers and implantable defibrillators—Security researchers have demonstrated potential vulnerabilities in cardiac devices that could allow their manipulation.²⁷ Timely disclosure and patching are crucial for preventing exploitation.
• Hospital-networked devices—There are numerous reports of ransomware attacks and other cyberincidents affecting hospital networks, including connected medical devices.²⁸ Though not always directly attributable to a lack of disclosure by the device manufacturer, these incidents highlight the risk inherent in connected healthcare devices. The Change Healthcare cyberattack in February 2024 targeting a healthcare technology provider significantly impacted patient records and service delivery, illustrating the interconnectedness and cascading effects of cybersecurity incidents in the healthcare ecosystem.²⁹
• Data breaches via medical devices—Some medical devices store or transmit sensitive patient data. Undisclosed and unaddressed vulnerabilities can result in data breaches, impacting patient privacy and potentially leading to identity theft or other harms.³⁰ Reports of healthcare data breaches are frequent, and millions of records are exposed annually due to hacking incidents, including ransomware attacks.³¹

It is crucial to recognize that in many cases the issue is not a complete absence of disclosure but rather the timeliness, clarity, and comprehensiveness of the information provided. Delayed or incomplete disclosures can leave healthcare providers and patients vulnerable.

Medical device manufacturers must proactively integrate threat intelligence into their cybersecurity practices. This involves diligently collecting and analyzing threat feeds, encompassing both publicly available open-source intelligence and more specific closed-source or proprietary intelligence. This might include membership subscriptions to enterprises such as the Health Information Sharing and Analysis Center (Health-ISAC) for sector-specific threat intelligence. By scrutinizing this information, manufacturers can identify potential threats and vulnerabilities relevant to their medical devices. When credible threats or vulnerabilities impacting their products are detected, they have a responsibility to act swiftly. This action should culminate in the issuance of CVDs or product security advisories to device users, providing timely information and guidance to mitigate potential risk and ensure patient safety. A proactive approach to threat intelligence is crucial for maintaining the security and integrity of medical devices in the face of an evolving cyberlandscape.

Moving Forward: Strengthening Cybersecurity Transparency in Healthcare

For medical device manufacturers, a proactive approach to cybersecurity disclosure is essential. This includes:

• Aligning with ISO/IEC 29147—Implement structured vulnerability disclosure programs for effective risk communication.
• Enhancing collaboration—Work with healthcare providers and regulatory bodies to ensure timely risk mitigation. 
• Implementing a materiality framework—Assess cyberrisk as rigorously as financial risk, ensuring that significant threats are disclosed to stakeholders.
• Strengthening FDA compliance—Stay up to date on evolving cybersecurity requirements to ensure safety and regulatory alignment.

Implications for the Healthcare and Insurance Industries

Healthcare providers require clear and timely communication from medical device manufacturers regarding known vulnerabilities, mitigation strategies, and security best practices. They should actively engage with manufacturers and demand transparency as part of their procurement and risk management processes. Implementing robust network security measures and regularly updating medical device software are also critical.

In addition, the insurance industry must consider the cybersecurity risk associated with medical devices when underwriting policies for healthcare providers and manufacturers.³² Understanding the disclosure practices and vulnerability management processes of medical device manufacturers is essential for risk assessment. Incidents stemming from medical device vulnerabilities could lead to significant financial losses and reputational damage for both healthcare providers and insurers.

Conclusion

While CVD remains unevenly enforced worldwide, its adoption is becoming a global imperative. Without proactive transparency, hospitals face ransomware attacks paralyzing critical care, insurers confront soaring liability costs, and patients endure preventable harm. The EU’s MDR, FDA guidelines, and ISO/IEC 29147 collectively push for CVD, but harmonized mandates—backed by healthcare providers, insurers, and WHO-aligned policymakers—are needed to prevent a race to the bottom in device security. Without a coordinated approach, the sector will remain reactive, waiting for the next breach to force change, rather than preventing harm proactively.

Endnotes

¹ World Health Organization, Medical Device Regulations: Global Overview and Guiding Principles, 2003
² US Food and Drug Administration (FDA), “Cybersecurity Vulnerabilities With Certain Patient Monitors From Contec and Epsimed: FDA Safety Communication,” USA, 2025
³ FDA, “Classify Your Medical Device,” USA
⁴ Wider, J.; “FBI Issues Alert on Unpatched and Outdated Medical Devices,” Healthcare Innovation, 2022
⁵ FDA, “FDA Warns Patients and Health Care Providers About Potential Cybersecurity Concerns With Certain Medtronic Insulin Pumps,”USA, 2018, “Class 2 Device Recall Medtronic MiniMed 600 Series Insulin Pump Systems,” USA, 2022
⁶ FDA, “Cybersecurity” 
⁷ FDA, “MOU [Memorandum of Understanding] 225-18-030,” USA, 2018
⁸ National Institute of Standards and Technology (NIST), The NIST Cybersecurity Framework (CSF) 2.0, USA, 2024
⁹ ENISA, “Coordinated Vulnerability Disclosure,” European Union
¹⁰ International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC), Joint Technical Committee on Information Technology (ISO/IEC JTC 1), ISO/IEC 15408-1:2022 Information security, cybersecurity and privacy protection―Evaluation criteria for IT security, Edition 4, 2022
¹¹ ISO/IEC JTC 1, ISO/IEC 29147:2018 Information technology―Security techniques―Vulnerability disclosure, Edition 2, 2018, ISO/IEC JTC 1, ISO/ IEC 30111:2019 Information technology― Security techniques―Vulnerability handling processes, Edition 2, 2019
¹² Secureframe, “ISO/IEC 29147” 
¹³ FDA, “Postmarket Management of Cybersecurity in Medical Devices,” USA, 2016
¹⁴ FDA, Food and Drug Omnibus Reform Act (FDORA) of 2022, USA, 2022
¹⁵ The HIPAA Journal, Security Breaches in Healthcare in 2023, 2024
¹⁶ Blue Goat Cyber, “FDA Medical Device Cybersecurity Requirements,” 2025
¹⁷ Khan, T.; “What Is a Software Bill of Materials (SBOM)?,” IBM, 2025
¹⁸ Cybellum, “Postmarket Management of Cybersecurity in Medical Devices,” 2024
¹⁹ FDA, “Medical Device Reporting (MDR): How to Report Medical Device Problems,” USA
²⁰ FDA, “MedWatch Forms for FDA Safety Reporting,” USA
²¹ Ge, B.C.; Mulcare, A.; “FDA Issues New Guidance for the Management of Cybersecurity in Medical Devices,” Crowell, 2018
²² FDA, “FDA Outlines Cybersecurity Recommendations for Medical Device Manufacturers,” USA, 2016
²³ US Government Accountability Office, “High-Risk Series: Urgent Action Needed to Address Critical Cybersecurity Challenges Facing the Nation,” USA, 2024
²⁴ National Electrical Manufacturers Association, Manufacturer Disclosure Statement for Medical Device Security, USA, 2019
²⁵ Volkman, E.; “FDA: Get Cybersecurity in Check or Don’t Bring a Medical Device to Market,” Drata, 2023
²⁶ FDA, “FDA Warns Against the Use of Unauthorized Devices for Diabetes Management,” USA, 2019
²⁷ Baranchuk, A.; Refaat, M.; et al.; “Cybersecurity for Cardiac Implantable Electronic Devices,” National Library of Medicine, 2018
²⁸ Neprash, H.; McGlave, C.; et al.; “Trends in Ransomware Attacks on US Hospitals, Clinics, and Other Health Care Delivery Organizations, 2016–2021,” JAMA Health Forum, 2022
²⁹ American Hospital Association, “Change Healthcare Cyberattack Underscores Urgent Need to Strengthen Cyber Preparedness for Individual Health Care Organizations and as a Field” 2025
³⁰ Espinosa, C.; “Medical Device Cybersecurity and the Threat of Data Breaches,” Forbes, 2024
³¹ Alder, S.; “Healthcare Data Breach Statistics,” The HIPAA Journal, 2025, Alder, S.; “The Biggest Healthcare Data Breaches of 2024,” The HIPAA Journal, 2025
³² Mattone, D.; Pancaldi, L.; et al.; “Elevating the Risk Function in Insurance: Building a Strategic Advantage,” McKinsey, 2024

JAYAKUMAR SUNDARAM | CISA, CC, ISO/IEC 27001 LA/LI

Is a cybersecurity and governance, risk, and compliance (GRC) lead with Creative Quality Management Services (CQMS), India. His focus for more than 13 years has been cybersecurity and information security audits. He has three decades of experience in information systems and IT program management. He can be contacted on LinkedIn at https://www.linkedin.com/in/jaysundaram.