--- title: "Medical Device Cybersecurity Glossary | MedTech Cyber Tips" description: "Plain-English definitions for SBOM, SPDF, 524B, RTA, eSTAR, MDS2, CVD, CBOM, TPLC and other medical device cybersecurity acronyms." lang: en json-ld: | [ { "@context": "https://schema.org", "@graph": [ { "@type": "WebSite", "@id": "https://medtechcybertips.com/#website", "url": "https://medtechcybertips.com/", "name": "MedTech Cyber Tips", "description": "The ultimate organized guide to medical device cybersecurity.", "inLanguage": "en-US", "publisher": { "@id": "https://medtechcybertips.com/#org" }, "potentialAction": { "@type": "SearchAction", "target": "https://medtechcybertips.com/topics?q={search_term_string}", "query-input": "required name=search_term_string" } }, { "@type": "Organization", "@id": "https://medtechcybertips.com/#org", "name": "MedTech Cyber Tips", "url": "https://medtechcybertips.com/", "logo": "https://medtechcybertips.com/icon-512.png", "sponsor": { "@type": "Organization", "name": "Blue Goat Cyber", "url": "https://bluegoatcyber.com", "sameAs": [ "https://home.bluegoatcyber.com/", "https://codebluechart.com/", "https://why.bluegoatcyber.com/", "https://spdf.bluegoatcyber.com/", "https://threatmodel.bluegoatcyber.com/", "https://pentesting.bluegoatcyber.com/", "https://premarket.bluegoatcyber.com/", "https://fdaresponse.bluegoatcyber.com/", "https://postmarket.bluegoatcyber.com/", "https://goatwatch.bluegoatcyber.com/" ] } } ] }, { "@context": "https://schema.org", "@type": "DefinedTermSet", "name": "Medical Device Cybersecurity Glossary", "hasDefinedTerm": [ { "@type": "DefinedTerm", "name": "SBOM (Software Bill of Materials)", "description": "A formal, machine-readable inventory of every software component (proprietary, open-source, third-party) that ships in a device. Required by FDA for cyber devices under Section 524B.", "url": "https://medtechcybertips.com/glossary/sbom" }, { "@type": "DefinedTerm", "name": "SPDF (Secure Product Development Framework)", "description": "A lifecycle framework (recognized by FDA) for embedding security into design, development, manufacturing, and postmarket. AAMI TIR57 and IEC 81001-5-1 are common reference standards.", "url": "https://medtechcybertips.com/glossary/spdf" }, { "@type": "DefinedTerm", "name": "524B (Section 524B of the FD&C Act)", "description": "The FDA cybersecurity authority for cyber devices. Requires a cybersecurity management plan, SBOM, vulnerability monitoring, and reasonable assurance of security in premarket submissions.", "url": "https://medtechcybertips.com/glossary/524b" }, { "@type": "DefinedTerm", "name": "RTA (Refuse to Accept)", "description": "An early FDA review checkpoint. If a 510(k) submission fails the RTA cybersecurity checklist, it is returned without substantive review, restarting the clock.", "url": "https://medtechcybertips.com/glossary/rta" }, { "@type": "DefinedTerm", "name": "eSTAR (electronic Submission Template And Resource)", "description": "FDA's interactive PDF template for 510(k) and De Novo submissions. Cybersecurity sections are guided and required.", "url": "https://medtechcybertips.com/glossary/estar" }, { "@type": "DefinedTerm", "name": "MDS2 (Manufacturer Disclosure Statement for Medical Device Security)", "description": "An IHE/HIMSS-standardized form (MDS2) that manufacturers provide to healthcare delivery organizations describing the security characteristics of a device.", "url": "https://medtechcybertips.com/glossary/mds2" }, { "@type": "DefinedTerm", "name": "CVD (Coordinated Vulnerability Disclosure)", "description": "A documented policy and process for receiving, triaging, and disclosing security vulnerabilities responsibly. Required for FDA cyber devices.", "url": "https://medtechcybertips.com/glossary/cvd" }, { "@type": "DefinedTerm", "name": "CBOM (Cryptographic Bill of Materials)", "description": "An emerging extension of the SBOM that catalogs cryptographic primitives, libraries, key sizes, and algorithms used by a device.", "url": "https://medtechcybertips.com/glossary/cbom" }, { "@type": "DefinedTerm", "name": "TPLC (Total Product Life Cycle)", "description": "FDA's framing for managing risk and quality from concept through end-of-support, including postmarket surveillance and security updates.", "url": "https://medtechcybertips.com/glossary/tplc" }, { "@type": "DefinedTerm", "name": "TIR57 (AAMI TIR57)", "description": "AAMI Technical Information Report describing security risk management principles for medical devices, the foundation referenced by FDA guidance.", "url": "https://medtechcybertips.com/glossary/tir57" }, { "@type": "DefinedTerm", "name": "SW96 (ANSI/AAMI SW96)", "description": "Standard for medical device security risk management activities and documentation, complementary to ISO 14971 safety risk management.", "url": "https://medtechcybertips.com/glossary/sw96" }, { "@type": "DefinedTerm", "name": "IEC 81001-5-1", "description": "International standard specifying a secure development lifecycle (SDL/SPDF) for health software and health IT systems.", "url": "https://medtechcybertips.com/glossary/iec-81001-5-1" }, { "@type": "DefinedTerm", "name": "STRIDE", "description": "A threat modeling taxonomy (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) widely used for medical device threat models.", "url": "https://medtechcybertips.com/glossary/stride" }, { "@type": "DefinedTerm", "name": "PMA (Premarket Approval)", "description": "FDA's most stringent device marketing pathway, used for high-risk Class III devices.", "url": "https://medtechcybertips.com/glossary/pma" }, { "@type": "DefinedTerm", "name": "510(k)", "description": "FDA premarket notification establishing substantial equivalence to a predicate device, the most common pathway for moderate-risk devices.", "url": "https://medtechcybertips.com/glossary/510k" }, { "@type": "DefinedTerm", "name": "De Novo", "description": "FDA pathway for novel low-to-moderate risk devices that have no predicate.", "url": "https://medtechcybertips.com/glossary/de-novo" }, { "@type": "DefinedTerm", "name": "SCA (Software Composition Analysis)", "description": "Tooling that scans software for known-vulnerable components and license risks, and is the primary mechanism for generating and maintaining an SBOM.", "url": "https://medtechcybertips.com/glossary/sca" }, { "@type": "DefinedTerm", "name": "PCCP (Predetermined Change Control Plan)", "description": "An FDA-authorized plan that lets a manufacturer pre-specify certain device modifications (often AI/ML or security updates) and implement them post-clearance without a new submission, provided changes stay within the agreed protocol.", "url": "https://medtechcybertips.com/glossary/pccp" }, { "@type": "DefinedTerm", "name": "QSR (Quality System Regulation (21 CFR 820))", "description": "FDA's current Good Manufacturing Practice requirements for medical devices, covering design controls, CAPA, document control, and production. Being replaced by QMSR in February 2026.", "url": "https://medtechcybertips.com/glossary/qsr" }, { "@type": "DefinedTerm", "name": "QMSR (Quality Management System Regulation)", "description": "FDA's updated quality system rule that harmonizes 21 CFR 820 with ISO 13485:2016. Takes effect February 2, 2026, replacing the legacy QSR.", "url": "https://medtechcybertips.com/glossary/qmsr" }, { "@type": "DefinedTerm", "name": "Predicate", "description": "A legally marketed device used as the basis for a 510(k) substantial-equivalence claim. Cybersecurity comparisons to the predicate are increasingly scrutinized by FDA.", "url": "https://medtechcybertips.com/glossary/predicate" }, { "@type": "DefinedTerm", "name": "FD&C Act (Federal Food, Drug, and Cosmetic Act)", "description": "The foundational U.S. statute giving FDA authority over food, drugs, and medical devices. Section 524B (added by the 2023 omnibus) created explicit cybersecurity authority for cyber devices.", "url": "https://medtechcybertips.com/glossary/fd-and-c-act" }, { "@type": "DefinedTerm", "name": "CVE (Common Vulnerabilities and Exposures)", "description": "A public catalog of disclosed security vulnerabilities, each assigned a unique CVE ID. Used for tracking known issues against SBOM components.", "url": "https://medtechcybertips.com/glossary/cve" }, { "@type": "DefinedTerm", "name": "CVSS (Common Vulnerability Scoring System)", "description": "An open framework for scoring vulnerability severity (0.0–10.0) based on exploitability and impact. FDA expects manufacturers to triage findings using CVSS plus device-specific clinical impact.", "url": "https://medtechcybertips.com/glossary/cvss" }, { "@type": "DefinedTerm", "name": "CWE (Common Weakness Enumeration)", "description": "A community catalog of software and hardware weakness types (e.g., CWE-79 XSS, CWE-787 out-of-bounds write). Useful in threat modeling and root-cause analysis.", "url": "https://medtechcybertips.com/glossary/cwe" }, { "@type": "DefinedTerm", "name": "VEX (Vulnerability Exploitability eXchange)", "description": "A machine-readable companion to an SBOM that states whether a known vulnerability actually affects a given product (e.g., 'not affected because component is not invoked'). Reduces noise from SBOM scans.", "url": "https://medtechcybertips.com/glossary/vex" }, { "@type": "DefinedTerm", "name": "PSIRT (Product Security Incident Response Team)", "description": "The internal team responsible for receiving vulnerability reports, coordinating fixes, and communicating with researchers, customers, and regulators. Required in practice to meet FDA CVD expectations.", "url": "https://medtechcybertips.com/glossary/psirt" }, { "@type": "DefinedTerm", "name": "SOUP (Software of Unknown Provenance)", "description": "IEC 62304 term for software not developed for a specific medical device (e.g., OS, libraries, OSS). Must be identified, risk-assessed, and tracked for vulnerabilities throughout the product lifecycle.", "url": "https://medtechcybertips.com/glossary/soup" }, { "@type": "DefinedTerm", "name": "IEC 62304", "description": "International standard for medical device software lifecycle processes, covering software safety classification (A/B/C), development, maintenance, risk, and configuration management.", "url": "https://medtechcybertips.com/glossary/iec-62304" }, { "@type": "DefinedTerm", "name": "ISO 14971", "description": "International standard for the application of risk management to medical devices. Security risk management (per AAMI SW96/TIR57) complements but does not replace ISO 14971 safety risk.", "url": "https://medtechcybertips.com/glossary/iso-14971" }, { "@type": "DefinedTerm", "name": "ISO 27001", "description": "International standard for information security management systems (ISMS). Often referenced for the manufacturer's enterprise security posture, distinct from product security.", "url": "https://medtechcybertips.com/glossary/iso-27001" }, { "@type": "DefinedTerm", "name": "UL 2900", "description": "UL standard series for testable cybersecurity criteria of network-connectable products and systems, including UL 2900-2-1 for healthcare and wellness devices.", "url": "https://medtechcybertips.com/glossary/ul-2900" }, { "@type": "DefinedTerm", "name": "NIST CSF (NIST Cybersecurity Framework)", "description": "A voluntary framework (Identify, Protect, Detect, Respond, Recover, Govern) widely referenced by FDA guidance and used to structure a manufacturer's overall security program.", "url": "https://medtechcybertips.com/glossary/nist-csf" }, { "@type": "DefinedTerm", "name": "PKI (Public Key Infrastructure)", "description": "The set of roles, policies, and systems for issuing, managing, and revoking digital certificates. Underpins device identity, signed firmware, and secure communications.", "url": "https://medtechcybertips.com/glossary/pki" }, { "@type": "DefinedTerm", "name": "HSM (Hardware Security Module)", "description": "Tamper-resistant hardware that generates, stores, and uses cryptographic keys. Often used in manufacturing to sign firmware and provision device identities.", "url": "https://medtechcybertips.com/glossary/hsm" }, { "@type": "DefinedTerm", "name": "mTLS (Mutual TLS)", "description": "TLS in which both client and server present and validate certificates. Common pattern for device-to-cloud and device-to-gateway authentication in connected medical devices.", "url": "https://medtechcybertips.com/glossary/mtls" }, { "@type": "DefinedTerm", "name": "OTA (Over-the-Air update)", "description": "Mechanism for remotely delivering signed firmware or software updates to deployed devices. FDA expects a documented, secure update path for the supported lifetime of the device.", "url": "https://medtechcybertips.com/glossary/ota" }, { "@type": "DefinedTerm", "name": "Secure Boot", "description": "A boot process that cryptographically verifies firmware/software integrity before executing it, anchored in a hardware Root of Trust. Foundational control for tamper resistance.", "url": "https://medtechcybertips.com/glossary/secure-boot" }, { "@type": "DefinedTerm", "name": "Root of Trust", "description": "An immutable hardware or firmware element (e.g., fused public key, secure element) that anchors all higher-level trust decisions like secure boot and attestation.", "url": "https://medtechcybertips.com/glossary/root-of-trust" }, { "@type": "DefinedTerm", "name": "Pen Test (Penetration Test)", "description": "Goal-oriented security testing that simulates an attacker against a device, its interfaces, and its supporting infrastructure. FDA expects penetration testing evidence for cyber devices.", "url": "https://medtechcybertips.com/glossary/pen-test" }, { "@type": "DefinedTerm", "name": "HDO (Healthcare Delivery Organization)", "description": "A hospital, clinic, or health system that deploys and operates medical devices. The primary audience for MDS2 forms and customer-facing security documentation.", "url": "https://medtechcybertips.com/glossary/hdo" }, { "@type": "DefinedTerm", "name": "MDR (EU Medical Device Regulation)", "description": "Regulation (EU) 2017/745 governing medical devices in the European Union. Includes cybersecurity expectations clarified by MDCG 2019-16 guidance.", "url": "https://medtechcybertips.com/glossary/mdr" }, { "@type": "DefinedTerm", "name": "Notified Body", "description": "An EU-designated conformity assessment organization that audits manufacturers and reviews technical documentation for CE marking under MDR/IVDR.", "url": "https://medtechcybertips.com/glossary/notified-body" } ] } ] --- [Skip to main content](#main) [ MedTech Cyber Tips The Ultimate Guide ](/) [Home](/)[Find Your Path](/journey)[All Topics](/topics)Reference[About](/about) Search ⌘K [Home](/) Reference # Glossary Plain-English definitions for the acronyms and standards you'll see across every topic. SBOM, VEX, VDR & CBOM at a glance ### Four artifacts, one inventory family SBOM Machine-readable list of every software component in the device. VEX Per-CVE exploitability status: affected, not affected, fixed. VDR Vulnerability disclosure report - the longer narrative. CBOM Cryptographic bill of materials: ciphers, key sizes, libraries. Think of SBOM as the parent inventory. VEX and VDR explain risk. CBOM zooms in on crypto. [5](#letter-5)[C](#letter-C)[D](#letter-D)[E](#letter-E)[F](#letter-F)[H](#letter-H)[I](#letter-I)[M](#letter-M)[N](#letter-N)[O](#letter-O)[P](#letter-P)[Q](#letter-Q)[R](#letter-R)[S](#letter-S)[T](#letter-T)[U](#letter-U)[V](#letter-V) ## Standards [ ### SBOM Software Bill of Materials A formal, machine-readable inventory of every software component (proprietary, open-source, third-party) that ships in a device. Required by FDA for cyber devices under Section 524B. Definition page ](/glossary/sbom)[ ### MDS2 Manufacturer Disclosure Statement for Medical Device Security An IHE/HIMSS-standardized form (MDS2) that manufacturers provide to healthcare delivery organizations describing the security characteristics of a device. Definition page ](/glossary/mds2)[ ### TIR57 AAMI TIR57 AAMI Technical Information Report describing security risk management principles for medical devices, the foundation referenced by FDA guidance. Definition page ](/glossary/tir57)[ ### SW96 ANSI/AAMI SW96 Standard for medical device security risk management activities and documentation, complementary to ISO 14971 safety risk management. Definition page ](/glossary/sw96)[ ### IEC 81001-5-1 International standard specifying a secure development lifecycle (SDL/SPDF) for health software and health IT systems. Definition page ](/glossary/iec-81001-5-1)[ ### SOUP Software of Unknown Provenance IEC 62304 term for software not developed for a specific medical device (e.g., OS, libraries, OSS). Must be identified, risk-assessed, and tracked for vulnerabilities throughout the product lifecycle. Definition page ](/glossary/soup)[ ### IEC 62304 International standard for medical device software lifecycle processes, covering software safety classification (A/B/C), development, maintenance, risk, and configuration management. Definition page ](/glossary/iec-62304)[ ### ISO 14971 International standard for the application of risk management to medical devices. Security risk management (per AAMI SW96/TIR57) complements but does not replace ISO 14971 safety risk. Definition page ](/glossary/iso-14971)[ ### ISO 27001 International standard for information security management systems (ISMS). Often referenced for the manufacturer's enterprise security posture, distinct from product security. Definition page ](/glossary/iso-27001)[ ### UL 2900 UL standard series for testable cybersecurity criteria of network-connectable products and systems, including UL 2900-2-1 for healthcare and wellness devices. Definition page ](/glossary/ul-2900)[ ### NIST CSF NIST Cybersecurity Framework A voluntary framework (Identify, Protect, Detect, Respond, Recover, Govern) widely referenced by FDA guidance and used to structure a manufacturer's overall security program. Definition page ](/glossary/nist-csf)[ ### MDR EU Medical Device Regulation Regulation (EU) 2017/745 governing medical devices in the European Union. Includes cybersecurity expectations clarified by MDCG 2019-16 guidance. Definition page ](/glossary/mdr)[ ### Notified Body An EU-designated conformity assessment organization that audits manufacturers and reviews technical documentation for CE marking under MDR/IVDR. Definition page ](/glossary/notified-body) ## Process [ ### SPDF Secure Product Development Framework A lifecycle framework (recognized by FDA) for embedding security into design, development, manufacturing, and postmarket. AAMI TIR57 and IEC 81001-5-1 are common reference standards. Definition page ](/glossary/spdf)[ ### CVD Coordinated Vulnerability Disclosure A documented policy and process for receiving, triaging, and disclosing security vulnerabilities responsibly. Required for FDA cyber devices. Definition page ](/glossary/cvd)[ ### PSIRT Product Security Incident Response Team The internal team responsible for receiving vulnerability reports, coordinating fixes, and communicating with researchers, customers, and regulators. Required in practice to meet FDA CVD expectations. Definition page ](/glossary/psirt)[ ### Pen Test Penetration Test Goal-oriented security testing that simulates an attacker against a device, its interfaces, and its supporting infrastructure. FDA expects penetration testing evidence for cyber devices. Definition page ](/glossary/pen-test)[ ### HDO Healthcare Delivery Organization A hospital, clinic, or health system that deploys and operates medical devices. The primary audience for MDS2 forms and customer-facing security documentation. Definition page ](/glossary/hdo) ## FDA [ ### 524B Section 524B of the FD&C Act The FDA cybersecurity authority for cyber devices. Requires a cybersecurity management plan, SBOM, vulnerability monitoring, and reasonable assurance of security in premarket submissions. Definition page ](/glossary/524b)[ ### RTA Refuse to Accept An early FDA review checkpoint. If a 510(k) submission fails the RTA cybersecurity checklist, it is returned without substantive review, restarting the clock. Definition page ](/glossary/rta)[ ### eSTAR electronic Submission Template And Resource FDA's interactive PDF template for 510(k) and De Novo submissions. Cybersecurity sections are guided and required. Definition page ](/glossary/estar)[ ### TPLC Total Product Life Cycle FDA's framing for managing risk and quality from concept through end-of-support, including postmarket surveillance and security updates. Definition page ](/glossary/tplc)[ ### PMA Premarket Approval FDA's most stringent device marketing pathway, used for high-risk Class III devices. Definition page ](/glossary/pma)[ ### 510(k) FDA premarket notification establishing substantial equivalence to a predicate device, the most common pathway for moderate-risk devices. Definition page ](/glossary/510k)[ ### De Novo FDA pathway for novel low-to-moderate risk devices that have no predicate. Definition page ](/glossary/de-novo)[ ### PCCP Predetermined Change Control Plan An FDA-authorized plan that lets a manufacturer pre-specify certain device modifications (often AI/ML or security updates) and implement them post-clearance without a new submission, provided changes stay within the agreed protocol. Definition page ](/glossary/pccp)[ ### QSR Quality System Regulation (21 CFR 820) FDA's current Good Manufacturing Practice requirements for medical devices, covering design controls, CAPA, document control, and production. Being replaced by QMSR in February 2026. Definition page ](/glossary/qsr)[ ### QMSR Quality Management System Regulation FDA's updated quality system rule that harmonizes 21 CFR 820 with ISO 13485:2016. Takes effect February 2, 2026, replacing the legacy QSR. Definition page ](/glossary/qmsr)[ ### Predicate A legally marketed device used as the basis for a 510(k) substantial-equivalence claim. Cybersecurity comparisons to the predicate are increasingly scrutinized by FDA. Definition page ](/glossary/predicate)[ ### FD&C Act Federal Food, Drug, and Cosmetic Act The foundational U.S. statute giving FDA authority over food, drugs, and medical devices. Section 524B (added by the 2023 omnibus) created explicit cybersecurity authority for cyber devices. Definition page ](/glossary/fd-and-c-act) ## Technical [ ### CBOM Cryptographic Bill of Materials An emerging extension of the SBOM that catalogs cryptographic primitives, libraries, key sizes, and algorithms used by a device. Definition page ](/glossary/cbom)[ ### STRIDE A threat modeling taxonomy (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) widely used for medical device threat models. Definition page ](/glossary/stride)[ ### SCA Software Composition Analysis Tooling that scans software for known-vulnerable components and license risks, and is the primary mechanism for generating and maintaining an SBOM. Definition page ](/glossary/sca)[ ### CVE Common Vulnerabilities and Exposures A public catalog of disclosed security vulnerabilities, each assigned a unique CVE ID. Used for tracking known issues against SBOM components. Definition page ](/glossary/cve)[ ### CVSS Common Vulnerability Scoring System An open framework for scoring vulnerability severity (0.0–10.0) based on exploitability and impact. FDA expects manufacturers to triage findings using CVSS plus device-specific clinical impact. Definition page ](/glossary/cvss)[ ### CWE Common Weakness Enumeration A community catalog of software and hardware weakness types (e.g., CWE-79 XSS, CWE-787 out-of-bounds write). Useful in threat modeling and root-cause analysis. Definition page ](/glossary/cwe)[ ### VEX Vulnerability Exploitability eXchange A machine-readable companion to an SBOM that states whether a known vulnerability actually affects a given product (e.g., 'not affected because component is not invoked'). Reduces noise from SBOM scans. Definition page ](/glossary/vex)[ ### PKI Public Key Infrastructure The set of roles, policies, and systems for issuing, managing, and revoking digital certificates. Underpins device identity, signed firmware, and secure communications. Definition page ](/glossary/pki)[ ### HSM Hardware Security Module Tamper-resistant hardware that generates, stores, and uses cryptographic keys. Often used in manufacturing to sign firmware and provision device identities. Definition page ](/glossary/hsm)[ ### mTLS Mutual TLS TLS in which both client and server present and validate certificates. Common pattern for device-to-cloud and device-to-gateway authentication in connected medical devices. Definition page ](/glossary/mtls)[ ### OTA Over-the-Air update Mechanism for remotely delivering signed firmware or software updates to deployed devices. FDA expects a documented, secure update path for the supported lifetime of the device. Definition page ](/glossary/ota)[ ### Secure Boot A boot process that cryptographically verifies firmware/software integrity before executing it, anchored in a hardware Root of Trust. Foundational control for tamper resistance. Definition page ](/glossary/secure-boot)[ ### Root of Trust An immutable hardware or firmware element (e.g., fused public key, secure element) that anchors all higher-level trust decisions like secure boot and attestation. Definition page ](/glossary/root-of-trust) MedTech Cyber Tips The organized, end-to-end guide to medical device cybersecurity, from concept through postmarket. Part of the Blue Goat Cyber family. Topics - [Overview](/topics/home) - [Why It Matters](/topics/why) - [SPDF](/topics/spdf) - [Threat Modeling](/topics/threatmodel) - [Pentesting](/topics/pentesting) Reference - [Glossary](/glossary) - [FDA vs MDR](/compare) - [Resources](/resources) - [Updates](/updates) - [RSS feed](/rss.xml) © 2026 medtechcybertips.com. An educational resource sponsored by Blue Goat Cyber. Not legal or regulatory advice.