IEC 62304 vs FDA Premarket Cybersecurity
Software safety lifecycle vs securing the device against attack.
What a comparison is not
A comparison is SPEQ’s reading of how two published documents differ. Neither is the right answer, it is not a determination of which applies to you, and neither is summarised in a way that replaces reading it.
IEC 62304 defines the software development lifecycle for medical device software — the processes that make software safe, organised around software safety classes A/B/C. The FDA’s premarket cybersecurity guidance addresses a different risk: protecting the device and its data from intentional attack across the total product lifecycle. One is safety-of-software engineering; the other is security engineering. Modern devices need both.
| ASPECT | IEC 62304 | FDA PREMARKET CYBERSECURITY |
|---|---|---|
| Concern | Software safety (does the software work safely?) | Security (is the device protected from attack?) |
| Organising concept | Software safety classes A / B / C by harm potential | Secure product development framework across the total product lifecycle |
| Key activities | Development planning, requirements, architecture, verification, risk, maintenance | Threat modeling, security risk management, SBOM, vulnerability management |
| Lifecycle | Development + maintenance of the software | Premarket design + postmarket monitoring/patching |
| Evidence | Software lifecycle documentation | Threat model, SBOM, security testing, and a plan for updates |
| Relationship | Safety engineering foundation | Security overlay; both feed the risk file |
Apply IEC 62304 to build medical device software through a disciplined lifecycle, classifying software items by safety class and sizing rigour accordingly.
Apply the FDA premarket cybersecurity expectations to secure the device — threat modeling, a software bill of materials (SBOM), security risk management, and a plan for monitoring and patching vulnerabilities after release.
Safety and security are different failures: IEC 62304 keeps the software from harming through malfunction; the FDA cybersecurity guidance keeps the device from being harmed through attack. A connected device needs both, and they interact — a security vulnerability can become a safety hazard. Run the 62304 lifecycle and layer security engineering (threat modeling, SBOM, vulnerability management) on top, feeding both into one risk file.
IEC 62304 vs FDA Premarket Cybersecurity: frequently asked questions
Common questions on how IEC 62304 and FDA Premarket Cybersecurity differ and when each applies.
Is IEC 62304 about cybersecurity?
No — IEC 62304 is about the software development lifecycle and software safety (preventing harm from software malfunction). Cybersecurity (protecting against intentional attack) is a separate discipline addressed by FDA premarket cybersecurity guidance and standards like IEC 81001-5-1; the two are complementary.
What are IEC 62304 software safety classes?
Class A (no injury or damage to health possible), Class B (non-serious injury possible), and Class C (death or serious injury possible). The class determines how much lifecycle rigour and documentation the software item requires.
What is an SBOM and why does the FDA want it?
A Software Bill of Materials lists the software components (including third-party and open-source) in a device. The FDA expects it because you cannot manage vulnerabilities you cannot see — the SBOM enables tracking and patching of components with newly discovered vulnerabilities across the product lifecycle.
Can a cybersecurity issue be a safety issue?
Yes. A vulnerability that lets an attacker alter device behaviour or data can create a patient-safety hazard, which is why security risk must feed the same risk-management process (ISO 14971) as safety risk, and why both the 62304 lifecycle and cybersecurity controls are needed.