[Federal Register Volume 89, Number 50 (Wednesday, March 13, 2024)]
[Notices]
[Pages 18421-18423]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2024-05295]
-----------------------------------------------------------------------
DEPARTMENT OF HEALTH AND HUMAN SERVICES
Food and Drug Administration
[Docket No. FDA-2021-D-1158]
Select Updates for the Premarket Cybersecurity Guidance: Section
524B of the Federal Food, Drug, and Cosmetic Act; Draft Guidance for
Industry and Food and Drug Administration Staff; Availability
AGENCY: Food and Drug Administration, HHS.
ACTION: Notice of availability.
-----------------------------------------------------------------------
SUMMARY: The Food and Drug Administration (FDA or Agency) is announcing
the availability of the draft guidance entitled ``Select Updates for
the Premarket Cybersecurity Guidance: Section 524B of the FD&C Act.''
This draft guidance proposes select updates to the final guidance
``Cybersecurity in Medical Devices: Quality System Considerations and
Content of Premarket Submissions.'' This draft guidance, when
finalized, will identify the information FDA generally considers to be
necessary for cyber devices to support obligations under the new
amendments to the Federal Food, Drug, and Cosmetic Act (FD&C Act) for
ensuring cybersecurity of devices. This draft guidance is not final nor
is it for implementation at this time.
DATES: Submit either electronic or written comments on the draft
guidance by May 13, 2024 to ensure that the Agency considers your
comment on this draft guidance before it begins work on the final
version of the guidance.
ADDRESSES: You may submit comments on any guidance at any time as
follows:
Electronic Submissions
Submit electronic comments in the following way:
Federal eRulemaking Portal: https://www.regulations.gov.
Follow the instructions for submitting comments. Comments submitted
electronically, including attachments, to https://www.regulations.gov
will be posted to the docket unchanged. Because your comment will be
made public, you are solely responsible for ensuring that your comment
does not include any confidential information that you or a third party
may not wish to be posted, such as medical information, your or anyone
else's Social Security number, or confidential business information,
such as a manufacturing process. Please note that if you include your
name, contact information, or other information that identifies you in
the body of your comments, that information will be posted on https://www.regulations.gov.
If you want to submit a comment with confidential
information that you do not wish to be made available to the public,
submit the comment as a written/paper submission and in the manner
detailed (see ``Written/Paper Submissions'' and ``Instructions'').
Written/Paper Submissions
Submit written/paper submissions as follows:
Mail/Hand Delivery/Courier (for written/paper
submissions): Dockets Management Staff (HFA-305), Food and Drug
Administration, 5630 Fishers Lane, Rm. 1061, Rockville, MD 20852.
For written/paper comments submitted to the Dockets
Management Staff, FDA will post your comment, as well as any
attachments, except for information submitted, marked and identified,
as confidential, if submitted as detailed in ``Instructions.''
Instructions: All submissions received must include the Docket No.
FDA-2021-D-1158 for ``Select Updates for the Premarket Cybersecurity
Guidance: Section 524B of the FD&C Act.'' Received comments will be
placed in the docket and, except for those submitted as ``Confidential
Submissions,'' publicly viewable at https://www.regulations.gov or at
the Dockets Management Staff between 9 a.m. and 4 p.m., Monday through
Friday, 240-402-7500.
Confidential Submissions--To submit a comment with
confidential information that you do not wish to be made publicly
available, submit your comments only as a written/paper submission. You
should submit two copies total. One copy will include the information
you claim to be confidential with a heading or cover note that states
``THIS DOCUMENT CONTAINS CONFIDENTIAL INFORMATION.'' The Agency will
review this copy, including the claimed confidential information, in
its consideration of comments. The second copy, which will have the
claimed confidential information redacted/blacked out, will be
available for public viewing and posted on https://www.regulations.gov.
Submit both copies to the Dockets Management Staff. If you do not wish
your name and contact information to be made publicly available, you
can provide this information on the cover sheet and not in the body of
your comments and you
[[Page 18422]]
must identify this information as ``confidential.'' Any information
marked as ``confidential'' will not be disclosed except in accordance
with 21 CFR 10.20 and other applicable disclosure law. For more
information about FDA's posting of comments to public dockets, see 80
FR 56469, September 18, 2015, or access the information at: https://www.govinfo.gov/content/pkg/FR-2015-09-18/pdf/2015-23389.pdf.
Docket: For access to the docket to read background documents or
the electronic and written/paper comments received, go to https://www.regulations.gov and insert the docket number, found in brackets in
the heading of this document, into the ``Search'' box and follow the
prompts and/or go to the Dockets Management Staff, 5630 Fishers Lane,
Rm. 1061, Rockville, MD 20852, 240-402-7500.
You may submit comments on any guidance at any time (see 21 CFR
10.115(g)(5)).
An electronic copy of the guidance document is available for
download from the internet. See the SUPPLEMENTARY INFORMATION section
for information on electronic access to the guidance. Submit written
requests for a single hard copy of the draft guidance document entitled
``Select Updates for the Premarket Cybersecurity Guidance: Section 524B
of the FD&C Act'' to the Office of Policy, Center for Devices and
Radiological Health, Food and Drug Administration, 10903 New Hampshire
Ave., Bldg. 66, Rm. 5431, Silver Spring, MD 20993-0002. Send one self-
addressed adhesive label to assist that office in processing your
request.
FOR FURTHER INFORMATION CONTACT: Suzanne Schwartz, Center for Devices
and Radiological Health, Food and Drug Administration, 10903 New
Hampshire Ave., Bldg. 66, Rm. 5410, Silver Spring, MD 20993-0002, 301-
796-6937; or James Myers, Center for Biologics Evaluation and Research,
Food and Drug Administration, 10903 New Hampshire Ave., Bldg. 71, Rm.
7301, Silver Spring, MD 20993, 240-402-7911.
SUPPLEMENTARY INFORMATION:
I. Background
Section 3305 of the Food and Drug Omnibus Reform Act of 2022
(FDORA), enacted on December 29, 2022, added section 524B ``Ensuring
Cybersecurity of Medical Devices'' to the FD&C Act. Under section
524B(a) of the FD&C Act (21 U.S.C. 360n-2(a)), a person who submits a
510(k), premarket approval application (PMA), product development
protocol (PDP), De Novo, or humanitarian device exemption (HDE) for a
device that meets the definition of a cyber device, as defined under
section 524B(c) of the FD&C Act, is required to submit information to
ensure that cyber devices meet the cybersecurity requirements under
section 524B(b) of the FD&C Act.
FDA is proposing to selectively update the final guidance
``Cybersecurity in Medical Devices: Quality System Considerations and
Content of Premarket Submissions.'' This draft guidance, when
finalized, will identify the information FDA generally considers to be
necessary to support obligations under section 524B of the FD&C Act.
Specifically, this draft guidance discusses who is required to comply
with section 524B, the devices subject to section 524B, and the
documentation recommendations for applicable premarket submissions.
Additionally, FDA provides recommendations regarding premarket
submissions for changes to cyber devices that had been previously
authorized by FDA through 510(k), De Novo, HDE, PDP, and PMA submission
pathways, and that require premarket submission. This draft guidance
also discusses FDA's review of whether there is a reasonable assurance
that the device and related systems are cybersecure for marketing
authorizations submitted for cyber devices.
This draft guidance is being issued consistent with FDA's good
guidance practices regulation (21 CFR 10.115). The draft guidance, when
finalized, will represent the current thinking of FDA on
``Cybersecurity in Medical Devices: Quality System Considerations and
Content of Premarket Submissions.'' It does not establish any rights
for any person and is not binding on FDA or the public. You can use an
alternative approach if it satisfies the requirements of the applicable
statutes and regulations.
II. Electronic Access
Persons interested in obtaining a copy of the draft guidance may do
so by downloading an electronic copy from the internet. A search
capability for all Center for Devices and Radiological Health guidance
documents is available at https://www.fda.gov/medical-devices/device-advice-comprehensive-regulatory-assistance/guidance-documents-medical-devices-and-radiation-emitting-products. This guidance document is also
available at https://www.regulations.gov, https://www.fda.gov/regulatory-information/search-fda-guidance-documents, or https://www.fda.gov/vaccines-blood-biologics/guidance-compliance-regulatory-information-biologics. Persons unable to download an electronic copy of
``Select Updates for the Premarket Cybersecurity Guidance: Section 524B
of the FD&C Act'' may send an email request to [email protected] to receive an electronic copy of the document.
Please use the document number GUI00001825 and complete title to
identify the guidance you are requesting.
III. Paperwork Reduction Act of 1995
While this guidance contains no new collection of information, it
does refer to previously approved FDA collections of information. The
previously approved collections of information are subject to review by
the Office of Management and Budget (OMB) under the Paperwork Reduction
Act of 1995 (PRA) (44 U.S.C. 3501-3521). The collections of information
in the following table have been approved by OMB:
------------------------------------------------------------------------
21 CFR part; guidance; or FDA OMB control
form Topic No.
------------------------------------------------------------------------
807, subpart E................. Premarket notification. 0910-0120
814, subparts A through E...... Premarket approval..... 0910-0231
814, subpart H................. Humanitarian Use 0910-0332
Devices; Humanitarian
Device Exemption.
812............................ Investigational Device 0910-0078
Exemption.
860, subpart D................. De Novo classification 0910-0844
process.
820............................ Current Good 0910-0073
Manufacturing Practice
(CGMP); Quality System
(QS) Regulation.
------------------------------------------------------------------------
[[Page 18423]]
Dated: March 8, 2024.
Lauren K. Roth,
Associate Commissioner for Policy.
[FR Doc. 2024-05295 Filed 3-12-24; 8:45 am]
BILLING CODE 4164-01-P