Premarket Software Guidance recommendation to list and evaluate the impact of unresolved software anomalies — security assessment extends this to include CWE classification and adversarial exploitability analysis.
FDA section V.A.5 says the assessment of an anomaly's impact on safety and effectiveness "may include an assessment for the potential security impacts of anomalies", that it "should also include consideration of any present Common Weakness Enumeration (CWE) categories", and that "The criteria and rationales for addressing the resulting anomalies with security impacts should be provided as part of documentation in the premarket submission."
CWE classification for anomalies with security implications, adversarial exploitability assessment distinguishing from probabilistic occurrence, and documentation of risk acceptance rationale.
Maps to
FDA Cybersecurity Guidance: §V.A.5 Security Assessment of Unresolved Anomalies
Requirement text
FDA's Premarket Software Guidance recommends that device manufacturers provide a list of software anomalies that exist in a product at the time of submission, and FDA recommends that, for each anomaly, device manufacturers conduct an evaluation of the anomaly's impact on the device's safety and effectiveness. FDA's Premarket Cybersecurity Guidance (current edition February 3, 2026) §V.A.5 says that the assessment for impacts to safety and effectiveness may include an assessment for the potential security impacts of anomalies, and that the assessment should also include consideration of any present Common Weakness Enumeration (CWE) categories. The criteria and rationales for addressing resulting anomalies with security impacts should be provided as part of documentation in the premarket submission.
Why this clause exists
Software anomalies — bugs present at the time of market submission — have a dual character that traditional software risk assessment does not address: the same bug that produces an acceptably rare random malfunction during normal clinical use may be continuously and deliberately exploited by a threat actor to manifest its impact at will. The guidance gives the example of an anomaly whose impact "might occur sporadically and be assessed to be acceptable from a software risk perspective", and says that a threat "might seek out these types of anomalies, and identify means to exploit them in order to manifest the anomaly's impact continuously, which could significantly impact the acceptability of the risk when compared to an anomaly assessment that didn't include security considerations." The guidance says the assessment "should also include consideration of any present Common Weakness Enumeration (CWE) categories", and recommends that "The criteria and rationales for addressing the resulting anomalies with security impacts should be provided as part of documentation in the premarket submission."
What changed
FDA's September 2023 final guidance (updated February 2026) section V.A.5 says "Some anomalies discovered during development or testing may have security implications and may also be considered vulnerabilities", that the assessment of impacts to safety and effectiveness "may include an assessment for the potential security impacts of anomalies", and that "The assessment should also include consideration of any present Common Weakness Enumeration (CWE) categories." It contrasts an anomaly whose impact "might occur sporadically and be assessed to be acceptable from a software risk perspective" with a threat that might seek out such anomalies "in order to manifest the anomaly's impact continuously".
Common gaps (what we see in audits)
- Anomaly risk assessment uses only probabilistic normal-use occurrence without adversarial analysis — Standard premarket anomaly risk assessments evaluate the probability of anomaly occurrence during normal clinical use. This systematically underestimates risk for anomalies that could be deliberately exploited — an adversary can trigger a sporadic bug continuously, converting an acceptable probabilistic risk into an unacceptable continuous harm scenario. FDA guidance V.A.5 recommends that the security impact assessment explicitly distinguish between normal-use occurrence probability and adversarial exploitability.