--- title: "Postmarket Vulnerability Response Template - MedTech Cyber…" description: "A working PSIRT playbook: intake, triage with CVSS + clinical impact, communication, fix, regulatory reporting, and lessons-learned loop." lang: en json-ld: | [ { "@context": "https://schema.org", "@graph": [ { "@type": "WebSite", "@id": "https://medtechcybertips.com/#website", "url": "https://medtechcybertips.com/", "name": "MedTech Cyber Tips", "description": "The ultimate organized guide to medical device cybersecurity.", "inLanguage": "en-US", "publisher": { "@id": "https://medtechcybertips.com/#org" }, "potentialAction": { "@type": "SearchAction", "target": "https://medtechcybertips.com/topics?q={search_term_string}", "query-input": "required name=search_term_string" } }, { "@type": "Organization", "@id": "https://medtechcybertips.com/#org", "name": "MedTech Cyber Tips", "url": "https://medtechcybertips.com/", "logo": "https://medtechcybertips.com/icon-512.png", "sponsor": { "@type": "Organization", "name": "Blue Goat Cyber", "url": "https://bluegoatcyber.com", "sameAs": [ "https://home.bluegoatcyber.com/", "https://codebluechart.com/", "https://why.bluegoatcyber.com/", "https://spdf.bluegoatcyber.com/", "https://threatmodel.bluegoatcyber.com/", "https://pentesting.bluegoatcyber.com/", "https://premarket.bluegoatcyber.com/", "https://fdaresponse.bluegoatcyber.com/", "https://postmarket.bluegoatcyber.com/", "https://goatwatch.bluegoatcyber.com/" ] } } ] }, { "@context": "https://schema.org", "@type": "HowTo", "name": "Postmarket Vulnerability Response Template", "description": "A working PSIRT playbook: intake, triage with CVSS + clinical impact, communication, fix, regulatory reporting, and lessons-learned loop.", "url": "https://medtechcybertips.com/resources/postmarket-vulnerability-response-template", "step": [ { "@type": "HowToSection", "position": 1, "name": "1. Intake", "itemListElement": [ { "@type": "HowToStep", "position": 1, "name": "Public security.txt / CVD page with PGP key" }, { "@type": "HowToStep", "position": 2, "name": "Monitored security@ inbox with auto-acknowledgment" }, { "@type": "HowToStep", "position": 3, "name": "Ticket created in tracking system within 1 business day" }, { "@type": "HowToStep", "position": 4, "name": "Initial reporter acknowledgment within 3 business days" }, { "@type": "HowToStep", "position": 5, "name": "ISAO / H-ISAC membership for community intel" } ] }, { "@type": "HowToSection", "position": 2, "name": "2. Triage", "itemListElement": [ { "@type": "HowToStep", "position": 1, "name": "CVSS v3.1 base score calculated" }, { "@type": "HowToStep", "position": 2, "name": "Rubric for Patient Safety Impact (none/low/med/high) applied" }, { "@type": "HowToStep", "position": 3, "name": "Exploitability assessed (network / adjacent / local / physical)" }, { "@type": "HowToStep", "position": 4, "name": "Affected SKUs, models, and firmware versions identified" }, { "@type": "HowToStep", "position": 5, "name": "Decision: fix, mitigate, or accept - with owner and date" } ] }, { "@type": "HowToSection", "position": 3, "name": "3. Communication", "itemListElement": [ { "@type": "HowToStep", "position": 1, "name": "Customer advisory drafted (template ready)" }, { "@type": "HowToStep", "position": 2, "name": "ICS-MEDICAL advisory coordinated with CISA where applicable" }, { "@type": "HowToStep", "position": 3, "name": "CVE reserved and assigned" }, { "@type": "HowToStep", "position": 4, "name": "Field-action / sales-rep talking points prepared" }, { "@type": "HowToStep", "position": 5, "name": "Internal stakeholders briefed (legal, regulatory, support)" } ] }, { "@type": "HowToSection", "position": 4, "name": "4. Remediation", "itemListElement": [ { "@type": "HowToStep", "position": 1, "name": "Root cause analysis completed" }, { "@type": "HowToStep", "position": 2, "name": "Patch validated against the threat model" }, { "@type": "HowToStep", "position": 3, "name": "Regression and security tests passed" }, { "@type": "HowToStep", "position": 4, "name": "SBOM and VEX updated and re-signed" }, { "@type": "HowToStep", "position": 5, "name": "Distribution method confirmed (OTA / service visit / portal)" } ] }, { "@type": "HowToSection", "position": 5, "name": "5. Regulatory Reporting", "itemListElement": [ { "@type": "HowToStep", "position": 1, "name": "MDR / MIR criteria evaluated" }, { "@type": "HowToStep", "position": 2, "name": "FDA reporting decision documented (with rationale)" }, { "@type": "HowToStep", "position": 3, "name": "EU MDR vigilance evaluation completed" }, { "@type": "HowToStep", "position": 4, "name": "Other-jurisdiction notifications tracked" }, { "@type": "HowToStep", "position": 5, "name": "Submission timestamps stored with the case file" } ] }, { "@type": "HowToSection", "position": 6, "name": "6. Lessons Learned", "itemListElement": [ { "@type": "HowToStep", "position": 1, "name": "Post-incident review held within 30 days" }, { "@type": "HowToStep", "position": 2, "name": "Threat model and risk file updated" }, { "@type": "HowToStep", "position": 3, "name": "Detection / SDLC controls improved" }, { "@type": "HowToStep", "position": 4, "name": "Metrics published to leadership" }, { "@type": "HowToStep", "position": 5, "name": "Knowledge base entry written for the PSIRT" } ] } ] }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://medtechcybertips.com" }, { "@type": "ListItem", "position": 2, "name": "Resources", "item": "https://medtechcybertips.com/resources" }, { "@type": "ListItem", "position": 3, "name": "Postmarket Vulnerability Response Template", "item": "https://medtechcybertips.com/resources/postmarket-vulnerability-response-template" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What is a PSIRT for a medical device manufacturer?", "acceptedAnswer": { "@type": "Answer", "text": "A Product Security Incident Response Team (PSIRT) is the cross-functional team that receives, triages, fixes, and communicates security vulnerabilities affecting your devices. It typically spans engineering, regulatory, quality, legal, support, and communications, and is required in practice to meet FDA postmarket expectations." } }, { "@type": "Question", "name": "When does a vulnerability have to be reported to the FDA?", "acceptedAnswer": { "@type": "Answer", "text": "When the vulnerability represents an uncontrolled risk that could cause serious harm or death, or when remediation cannot be deployed quickly enough to keep risk acceptable. The FDA's 2016 postmarket cybersecurity guidance and Section 524B together set the criteria and reporting timelines." } }, { "@type": "Question", "name": "How fast should we acknowledge a researcher's vulnerability report?", "acceptedAnswer": { "@type": "Answer", "text": "Industry norms (and most published CVD policies) call for an initial acknowledgment within 1-3 business days and a triage decision within 10 business days. Your CVD policy should publish your specific SLAs for acknowledgment, triage, and fix release." } }, { "@type": "Question", "name": "Do we need to issue CVEs for our own product vulnerabilities?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. The FDA expects manufacturers to coordinate disclosure with CISA's ICS-MEDICAL advisory program where applicable, and to reserve and publish CVEs for vulnerabilities affecting their devices. CVE issuance is essential for downstream vulnerability tracking by hospitals." } }, { "@type": "Question", "name": "What is the difference between a CVD policy and a PSIRT charter?", "acceptedAnswer": { "@type": "Answer", "text": "The CVD policy is external-facing and tells researchers how to report to you and what to expect. The PSIRT charter is internal-facing and defines who does what when a report arrives: triage owner, engineering escalation, regulatory decision-maker, and communications lead. You need both." } }, { "@type": "Question", "name": "How do we handle a vulnerability we cannot patch quickly?", "acceptedAnswer": { "@type": "Answer", "text": "Publish compensating controls (network segmentation, disabled feature, temporary workaround), notify affected customers, document the risk decision in your risk management file, and set a target remediation date. FDA accepts risk-based delay when it is transparent and justified; silent inaction is not accepted." } } ] } ] --- [Skip to main content](#main) [ MedTech Cyber Tips The Ultimate Guide ](/) [Home](/)[Find Your Path](/journey)[All Topics](/topics)Reference[About](/about) Search ⌘K [All resources](/resources) Postmarket · 7 min · 30 items # Postmarket Vulnerability Response Template When a researcher emails or a CVE drops on Friday afternoon, you don't want to be designing a process. Use this as the skeleton of your PSIRT playbook. Progress 0 / 30 (0%) Reset Print ## 1\. Intake Make it easy for researchers, customers, and ISAOs to reach you. - Public security.txt / CVD page with PGP key - Monitored security@ inbox with auto-acknowledgment - Ticket created in tracking system within 1 business day - Initial reporter acknowledgment within 3 business days - ISAO / H-ISAC membership for community intel ## 2\. Triage Score on technical severity AND clinical impact. - CVSS v3.1 base score calculated - Rubric for Patient Safety Impact (none/low/med/high) applied - Exploitability assessed (network / adjacent / local / physical) - Affected SKUs, models, and firmware versions identified - Decision: fix, mitigate, or accept - with owner and date ## 3\. Communication Patients, clinicians, and HDOs need timely, useful information. - Customer advisory drafted (template ready) - ICS-MEDICAL advisory coordinated with CISA where applicable - CVE reserved and assigned - Field-action / sales-rep talking points prepared - Internal stakeholders briefed (legal, regulatory, support) ## 4\. Remediation Ship the fix or a documented compensating control. - Root cause analysis completed - Patch validated against the threat model - Regression and security tests passed - SBOM and VEX updated and re-signed - Distribution method confirmed (OTA / service visit / portal) ## 5\. Regulatory Reporting Know which thresholds trigger which filings. - MDR / MIR criteria evaluated - FDA reporting decision documented (with rationale) - EU MDR vigilance evaluation completed - Other-jurisdiction notifications tracked - Submission timestamps stored with the case file ## 6\. Lessons Learned Close the loop so the next one is faster. - Post-incident review held within 30 days - Threat model and risk file updated - Detection / SDLC controls improved - Metrics published to leadership - Knowledge base entry written for the PSIRT ## Frequently asked questions Quick answers to the questions teams most often ask about this topic. ### What is a PSIRT for a medical device manufacturer? A Product Security Incident Response Team (PSIRT) is the cross-functional team that receives, triages, fixes, and communicates security vulnerabilities affecting your devices. It typically spans engineering, regulatory, quality, legal, support, and communications, and is required in practice to meet FDA postmarket expectations. ### When does a vulnerability have to be reported to the FDA? When the vulnerability represents an uncontrolled risk that could cause serious harm or death, or when remediation cannot be deployed quickly enough to keep risk acceptable. The FDA's 2016 postmarket cybersecurity guidance and Section 524B together set the criteria and reporting timelines. ### How fast should we acknowledge a researcher's vulnerability report? Industry norms (and most published CVD policies) call for an initial acknowledgment within 1-3 business days and a triage decision within 10 business days. Your CVD policy should publish your specific SLAs for acknowledgment, triage, and fix release. ### Do we need to issue CVEs for our own product vulnerabilities? Yes. The FDA expects manufacturers to coordinate disclosure with CISA's ICS-MEDICAL advisory program where applicable, and to reserve and publish CVEs for vulnerabilities affecting their devices. CVE issuance is essential for downstream vulnerability tracking by hospitals. ### What is the difference between a CVD policy and a PSIRT charter? The CVD policy is external-facing and tells researchers how to report to you and what to expect. The PSIRT charter is internal-facing and defines who does what when a report arrives: triage owner, engineering escalation, regulatory decision-maker, and communications lead. You need both. ### How do we handle a vulnerability we cannot patch quickly? Publish compensating controls (network segmentation, disabled feature, temporary workaround), notify affected customers, document the risk decision in your risk management file, and set a target remediation date. FDA accepts risk-based delay when it is transparent and justified; silent inaction is not accepted. Sponsored | how Blue Goat Cyber℠ helps ### Stay compliant after launch Blue Goat Cyber℠ runs postmarket vulnerability management, coordinated disclosure, and patch governance so your team can focus on the next release. [Set up postmarket cybersecurity](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session) 4.9 / 5 · 15+ client reviews "BlueGoat supported LLA Technologies and the Recordis™ platform through critical cybersecurity testing required for our FDA 510(k) submission. Their work demonstrated technical rigor, a strong understanding of regulatory expectations, and an ability to translate complex findings into meaningful improvements. They maintained excellent communication, managed the engagement professionally, and met all timelines - enabling us to secure certification without delay." Andy Parkins , LLA Technologies (Recordis™) 250+ FDA submissions · 0 rejections Veteran-owned, Scottsdale AZ Exclusively medical device cybersecurity [ Previous SBOM Quality & VEX Readiness Checklist ](/resources/sbom-quality-checklist)[ Back All resources ](/resources) MedTech Cyber Tips The organized, end-to-end guide to medical device cybersecurity, from concept through postmarket. Part of the Blue Goat Cyber family. Topics - [Overview](/topics/home) - [Why It Matters](/topics/why) - [SPDF](/topics/spdf) - [Threat Modeling](/topics/threatmodel) - [Pentesting](/topics/pentesting) Reference - [Glossary](/glossary) - [FDA vs MDR](/compare) - [Resources](/resources) - [Updates](/updates) - [RSS feed](/rss.xml) © 2026 medtechcybertips.com. An educational resource sponsored by Blue Goat Cyber. Not legal or regulatory advice.