Post-market cybersecurity: what FDA actually expects once your device is on the market

Date: August 20, 2026, 1:00 to 2:00 PM ET
Presenters: Christopher Gates, founder and CEO, arsMedSecurity, and Etienne Nichols, Greenlight Guru

Manufacturers often treat FDA clearance as the finish line for cybersecurity, but the agency treats it as the starting point of a program that has to run for the rest of the device's life, covering monitoring, vulnerability assessment, remediation, and reporting. Get a step wrong along the way and a routine patch decision can turn into a reportable correction, or an inspection finding.

Christopher Gates, founder and CEO of arsMedSecurity and co-chair of the Medical Device Manufacturer Security Council at the Health Information Sharing and Analysis Center (Health-ISAC), has spent his career helping device makers build these programs instead of guessing at them. In this session, he walks through what FDA's postmarket and 2026 cybersecurity guidance actually require after launch: how to tell a controlled risk from an uncontrolled one, when a fix counts as a device enhancement versus a reportable correction, what belongs in your software bill of materials (SBOM), and how to plan for the day a component reaches end of support before your device does.

If your team manages a device that is already on the market, or is in development, this session gives you a clear, defensible way to run post-market cybersecurity instead of reacting to it one vulnerability at a time.

You will learn:

• How to tell a controlled cybersecurity risk from an uncontrolled one, and why the distinction drives your reporting obligations
• When a fix counts as a device enhancement versus a reportable correction under 21 CFR Part 806
• Ongoing sustaining cybersecurity testing
• How to plan for the day a component reaches end of support before your device does