Executive Summary

CISA, in coordination with NIST and other US federal agencies, published on July 29, 2026 a joint guide establishing the minimum software elements that Software Bill of Materials (SBOM) must include for connected medical devices. The guide is mandatory for new medical devices submitted for FDA approval after October 1, 2023 (per Section 524B of the FD&C Act).

Although the guide is US federal, it has global implications because any manufacturer that wants to sell in the US market must comply. In the EU, the MDR framework (§10.1 and §10.4) has similar requirements that are progressively aligning.

Key Points

  • Section 524B FD&C Act: SBOMs must be available to FDA and the Department of Homeland Security
  • Minimum elements: complete list of software components, dependencies, versions, licenses, known vulnerabilities
  • Standard format: SPDX, CycloneDX or SWID tags (all three accepted)
  • Continuous updating: SBOM must be kept up to date throughout the device lifecycle
  • Applicability: medical devices with software that can connect to the internet or to other devices

Regulatory Implications

MDR (Medical Device Regulation EU): The MDR §10.1 technical documentation must include information about software components. The new SBOM guide is more specific than current MDR requirements. Manufacturers selling in both EU and US must align both frameworks.

NIS2: European hospitals using medical devices must request SBOMs from their manufacturers to comply with supply chain risk management (art. 21 NIS2).

HIPAA: §164.308(a)(1)(ii)(B) risk analyses must consider the software composition of devices that store or process PHI. SBOM facilitates this analysis.

ENS: CCN-STIC 810 (audit guide) and CCN-STIC 817 (risk management) require asset inventory. SBOM complements the medical device inventory.

Recommendation

  1. Request SBOMs from your manufacturers: if you have medical devices in production, ask each manufacturer to provide you with the SBOM of the installed model.
  2. Maintain centralized registry: create a database with all received SBOMs. Format: CycloneDX (more widespread in Europe).
  3. Cross-reference with vulnerability databases: use SBOM to search CVEs against NVD and vendor advisories. Identify which patients are potentially at risk.
  4. Annual audit: review your SBOM inventory against newly published vulnerabilities. CVEs in critical components (OpenSSL, log4j, etc.) can affect medical devices for years.
  5. Remediation plan: for each critical CVE, have a clear process: contact manufacturer, apply patch if available, document risk acceptance decision if you decide to accept the risk.

Source: AHA News - SBOM guidance for medical devices

This analysis is part of HealthSec, the weekly briefing on healthcare cybersecurity.