IEC 62304 vs FDA Cybersecurity
What's actually different between the QMS regulations medical device manufacturers must follow — clause-by-clause comparison from the Kelsey Quality crosswalk library.
kelseyqms.com/crosswalk/compare/iec-62304-vs-cybersecurity
vs
Explore individual standards
26
0
26
15
What's actually different
StatusCurrent — recognized consensus standardCurrent — guidance document, not regulation
Effective period2006 – present (Amd 1:2015)Sep 2023 – present
Total requirements2623
Risk integrationSoftware-specific risk via ISO 14971; class drives requirement depthExploitability-based risk; cybersecurity threats traceable to ISO 14971 file
Plan maintenanceSoftware development plan updated throughout lifecyclePatch management plan with severity-based SLAs required
Document approvalVerification records required per phase and safety classThreat model, SBOM, and vulnerability assessment required at submission
Most common gapInternal software controls used to lower safety classificationIncomplete threat models lacking system context; static SBOMs missing transitive deps
Audit focusClassification rationale, SOUP list currency, plan update recordsThreat model interface coverage, SBOM currency, vulnerability assessment at submission date
What's shared, what's distinct
0
- No items.
26
- • Software Safety Classification
- • Software Development Planning
- • Software Requirements Analysis
- • Software Architectural Design
- • Software unit implementation
- • Software System Testing
- + 20 more
15
- • Threat Model Documentation
- • Cybersecurity Risk Assessment
- • Coordinated Vulnerability Disclosure
- • End-of-Life Cybersecurity Plan
- • Penetration Testing Evidence
- • Authentication Controls for Medical Devices
- + 9 more