FDA reissues cybersecurity guidance to align with QMSR

The US Food and Drug Administration (FDA) has reissued a final guidance on quality system management considerations for medical device cybersecurity following the agency’s transition from the Quality System Regulation (QSR) to the Quality System Management Regulation (QMSR, 21 CFR 820).

The new guidance replaces references to the QSR with references to the QMSR and, more specifically, to ISO 13485 standard. FDA, in explaining the update, stated: “This guidance supersedes the final guidance titled ‘Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions’ and published June 2025.”

When discussing general cybersecurity principles, FDA refers sponsors to the QMSR, replacing the QSR, and notes that quality management system requirements are found in QMSR 21 CFR part 820. The agency also added that the updated regulation now references ISO 13485 throughout the guidance.

While the guidance, titled “Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions,” is final, FDA is still taking comments from stakeholders on www.regulations.gov under docket no. FDA-D-1158.