SEC. 2. ENSURING CYBERSECURITY OF MEDICAL DEVICES. 
(a) IN GENERAL.—Subchapter A of chapter V of the 
Federal Food, Drug, and Cosmetic Act (21 U.S.C. 351 
et seq.) is amended by adding at the end the following: 
‘‘SEC. 524B. ENSURING CYBERSECURITY OF DEVICES. 
‘‘(a) IN GENERAL.—For purposes of ensuring cyber-
security throughout the lifecycle of a cyber device, any per-
son who submits a premarket submission for the cyber de-
vice shall include such information as the Secretary may 
require to ensure that the cyber device meets such cyberse-
curity requirements as the Secretary determines to be ap-
propriate to demonstrate a reasonable assurance of safety 
and effectiveness, including at a minimum the cybersecu-
rity requirements under subsection (b). The Secretary may 
establish exemptions to the requirements under this sub-
section. 
‘‘(b) CYBERSECURITY REQUIREMENTS.—At a min-
imum, the manufacturer of a cyber device shall meet the 
following cybersecurity requirements: 
‘‘(1) The manufacturer shall have a plan to ap-
propriately monitor, identify, and address in a rea-
sonable time postmarket cybersecurity vulnerabilities 
and exploits. 
‘‘(2) The manufacturer shall— 
‘‘(A) have a plan and procedures for a Co-
ordinated Vulnerability Disclosure to be part of 
VerDate Sep 11 2014 
22:11 Mar 16, 2022
Jkt 029200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H7084.IH
H7084
kjohnson on DSK79L0C42PROD with BILLS
submissions to the Food and Drug Administra-
tion; and 
‘‘(B) collect and maintain such other infor-
mation as the Secretary may (by order pub-
lished in the Federal Register or by other proc-
ess) require to demonstrate a reasonable assur-
ance of the safety and effectiveness of the cyber 
device. 
‘‘(3) The manufacturer shall design, develop, 
and maintain processes and procedures to make 
available updates and patches to the cyber device 
and related systems throughout the lifecycle of the 
cyber device to address— 
‘‘(A) on a reasonably justified regular 
cycle, known unacceptable vulnerabilities; and 
‘‘(B) as soon as possible out of cycle, crit-
ical vulnerabilities that could cause uncontrolled 
risks. 
‘‘(4) The manufacturer shall furnish to the Sec-
retary a software bill of materials, including com-
mercial, open-sourced, and off-the-shelf software 
components that will be provided to users. 
‘‘(c) SUBSTANTIAL EQUIVALENCE.—In making a de-
termination of substantial equivalence under section 
513(i) for a cyber device, the Secretary may— 
VerDate Sep 11 2014 
22:11 Mar 16, 2022
Jkt 029200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H7084.IH
H7084
kjohnson on DSK79L0C42PROD with BILLS
‘‘(1) find that cybersecurity information for the 
cyber device described in the relevant premarket 
submission in the cyber device’s use environment is 
inadequate; and 
‘‘(2) issue a nonsubstantial equivalence deter-
mination based on this finding. 
‘‘(d) DEFINITION.—In this section: 
‘‘(1) The term ‘cyber device’ means a device 
that— 
‘‘(A) includes software; or 
‘‘(B) is intended to connect to the internet. 
‘‘(2) The term ‘lifecycle of the cyber device’ in-
cludes the postmarket lifecycle of the cyber device. 
‘‘(3) The term ‘premarket submission’ means 
any submission under section 510(k), 513, 515(c), 
515(f), or 520(m).’’. 
(b) PROHIBITED ACT.—Section 301(q) of the Fed-
eral Food, Drug, and Cosmetic Act (21 U.S.C. 331(q)) 
is amended by adding at the end the following: 
‘‘(3) The failure to comply with any requirement 
under section 524B (relating to ensuring the cybersecu-
rity).’’. 
(c) ADULTERATION.—Section 501 of the Federal 
Food, Drug, and Cosmetic Act (21 U.S.C. 351) is amend-
ed by inserting after paragraph (j) the following: 
VerDate Sep 11 2014 
22:11 Mar 16, 2022
Jkt 029200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H7084.IH
H7084
kjohnson on DSK79L0C42PROD with BILLS
‘‘(k) If it is a device with respect to which the sponsor 
is in violation of section 524B (relating to ensuring cyber-
security).’’. 
(d) MISBRANDING.—Section 502(t) of the Federal 
Food, Drug, and Cosmetic Act (21 U.S.C. 352(t)) is 
amended— 
(1) by striking ‘‘or (3)’’ and inserting ‘‘(3)’’; 
and 
(2) by inserting before the period at the end the 
following: ‘‘, or (4) to furnish a software bill of ma-
terials as required under section 524B (relating to 
ensuring the cybersecurity)’’. 
Æ 
VerDate Sep 11 2014 
22:11 Mar 16, 2022
Jkt 029200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6301
E:\BILLS\H7084.IH
H7084
kjohnson on DSK79L0C42PROD with BILLS