General secure communications requirements and encryption of data at rest/in transit from existing design controls — cryptographic controls extend these to the selection of algorithms and protocols and to "appropriate key generation, distribution, management and protection", which Appendix 1.C recommends.
FDA Appendix 1.C recommends current NIST recommended standards for cryptography (e.g., FIPS 140-3) or equivalent-strength protection, not implementing deprecated or disallowed algorithms, a system architecture in which compromise of one device cannot reveal keys for other devices, and avoiding device serial numbers as keys or as part of keys.
Algorithm selection (current vs. deprecated), key management architecture (master-key and serial-number key patterns), and protocol downgrade controls.
Maps to
FDA Cybersecurity Guidance: §Appendix 1.C Cryptography
Requirement text
FDA's Premarket Cybersecurity Guidance (current edition February 3, 2026) recommends that cryptographic algorithms and protocols be implemented to achieve secure-by-design objectives. Manufacturers should select industry-standard cryptographic algorithms and protocols, use current NIST recommended standards (e.g., FIPS 140-3) or equivalent-strength cryptographic protection, and design system architectures that prevent full compromise of any single device from revealing keys for other devices. Deprecated or disallowed cryptographic algorithms should not be implemented.
Why this clause exists
Cryptography is the technical foundation on which authentication, integrity, and confidentiality controls are built — and Appendix 1.C says "several commercial products that include cryptographic protections have been shown to have exploitable vulnerabilities due to improper configurations and/or implementations." It recommends "current NIST recommended standards for cryptography (e.g., FIPS 140-3) or equivalent-strength cryptographic protection that are expected to be considered cryptographically strong throughout the service life of the device", and says "Manufacturers should not implement cryptographic algorithms that have been deprecated or disallowed in applicable standards or best practices". It also recommends a system architecture and security controls "to prevent a situation where the full compromise of any single device can result in the ability to reveal keys for other devices", for example avoiding "master-keys stored on device". It recommends to "avoid using device serial numbers as keys or as part of keys", noting that "Device serial numbers may be disclosed by patients seeking additional information on their device or might be disclosed during a device recall to identify affected products".
What changed
FDA's September 2023 final guidance (updated February 2026) Appendix 1.C recommends specific cryptographic design and implementation practices; the guidance is nonbinding. It recommends using current NIST recommended standards for cryptography (e.g., FIPS 140-3) or equivalent-strength cryptographic protection, not implementing cryptographic algorithms that have been deprecated or disallowed in applicable standards or best practices (e.g., NIST SP 800-131A), and designing the system architecture so that full compromise of any single device cannot reveal keys for other devices (for example, avoiding master keys stored on the device). The guidance notes that several commercial products that include cryptographic protections have been shown to have exploitable vulnerabilities due to improper configurations and/or implementations.
Common gaps (what we see in audits)
- Use of deprecated cryptographic algorithms or improper key derivation — Cryptographic protections can be described without confirming algorithm currency — devices may implement algorithms with 'legacy use' or deprecated status in current NIST standards. FDA Appendix 1.C recommends "current NIST recommended standards for cryptography (e.g., FIPS 140-3) or equivalent-strength cryptographic protection", says "Manufacturers should not implement cryptographic algorithms that have been deprecated or disallowed in applicable standards or best practices", and recommends avoiding "key derivation algorithms based solely on device identifiers or other readily discoverable information" and avoiding "device serial numbers as keys or as part of keys".