FDA Guidance Update: Navigating the QMSR Cybersecurity Shift

From 21 CFR 820 to ISO 13485:2016 

The most significant change is the move to the QMSR, which now incorporates ISO 13485:2016 by reference. This means your cybersecurity documentation must now map to specific ISO clauses rather than just the traditional 21 CFR 820 text. 

• Design and development: References have shifted from 21 CFR 820.30 to ISO 13485 Clause 7.3. 
• Validation: Software validation is now specifically tied to Subclause 7.3.7. 
• CAPA/Improvement: Corrective and preventive actions are now addressed under Subclause 8.5. 

Documented risk management is no longer optional

Under the new QMSR, the FDA emphasizes that ISO 13485 Subclause 7.1 explicitly requires manufacturers to document one or more processes for risk management in product realization. This reinforces that cybersecurity risk management must be an integrated, documented part of your entire QMS. 

Overview table:

Refined technical terminology

The 2026 update introduces more precise definitions in Appendix 5 to align with NIST and global standards: 

• Least privilege: Formally defined as a security principle to restrict access privileges to the absolute minimum necessary. 
• Threat surface: Now explicitly defined as the set of points where a cyber threat can attempt to enter or extract data. 
• Quality of service (QoS): Added to address measurable performance factors like bandwidth, latency, and jitter. 

Mandatory requirements for ‘cyber devices’

The obligations under Section 524B of the FD&C Act remain mandatory. If your product qualifies as a "cyber device," you must provide: 

• A comprehensive Software Bill of Materials (SBOM). 
• Detailed postmarket cybersecurity plans to monitor and address vulnerabilities in a reasonable time. 
• Processes to provide reasonable assurance that the device and related systems are cybersecure. 

At Applus+ Laboratories, we specialize in bridging the gap between technical cybersecurity and complex regulatory requirements. Whether you are remapping your QMS to ISO 13485 or preparing a new 510(k), we are here to ensure your submission is robust and compliant with the latest 2026 expectations.