Select Updates for the Premarket Cybersecurity Guidance: Section 524B of the Federal Food, Drug, and Cosmetic Act; Draft Guidance for Industry and Food and Drug Administration Staff; Availability, 18421-18423 [2024-05295]

Download as PDF lotter on DSK11XQN23PROD with NOTICES1 Federal Register / Vol. 89, No. 50 / Wednesday, March 13, 2024 / Notices currently listed as the NDA holder in the Orange Book. On August 6, 2020, Celgene submitted high level results from the Ro-CHOP study to FDA, which indicated the study failed to meet its primary endpoint of progression-free survival. On May 14, 2021, Celgene informed FDA that after careful consideration, Celgene decided to voluntarily withdraw the PTCL indication from ISTODAX (romidepsin) for injection, 10 mg/vial. On June 17, 2021, Celgene submitted a supplemental NDA proposing to remove the PTCL indication. On July 14, 2021, Celgene submitted a letter asking FDA to withdraw approval of the PTCL indication pursuant to § 314.150(d) (21 CFR 314.150(d)) and waiving its opportunity for a hearing. On August 27, 2021, Teva submitted a labeling supplement proposing to remove the PTCL indication. On September 12, 2021, the Agency requested Teva voluntarily request withdrawal of the PTCL indication pursuant to § 314.150(d) and waive its opportunity for a hearing. On September 14, 2021, Teva amended its supplement by submitting a cover letter requesting withdrawal of approval of the PTCL indication pursuant to § 314.150(d) and waiving its opportunity for a hearing. On December 8, 2021, FDA approved the supplemental NDA to revise the labeling to remove the PTCL indication. In the Federal Register of May 9, 2022 (87 FR 27644), FDA announced that it was withdrawing approval of the PTCL indications for ISTODAX (romidepsin) for injection, 10 mg/vial, and Romidepsin Injection. Therefore, Romidepsin Injection is only indicated for the treatment of CTCL in adult patients who have received at least one prior systemic therapy. The Agency will continue to list Teva’s Romidepsin Injection, 10 mg/2 mL (5 mg/mL) and 27.5 mg/5.5 mL (5 mg/mL), in the ‘‘Discontinued Drug Product List’’ section of the Orange Book. The ‘‘Discontinued Drug Product List’’ delineates, among other items, drug products that have been discontinued from marketing for reasons other than safety or effectiveness. FDA will accept and, where appropriate, approve ANDAs that refer to these drug products, but does not intend to do so if they propose to include the PTCL indication (see, e.g., section 505(j)(2)(A)(v) and (j)(4)(G) of the FD&C Act and 21 CFR 314.94(a)(8)(iv) and 314.127(a)(7)). If FDA determines that labeling for these drug products should be revised to meet current standards, the Agency will advise ANDA applicants to submit such labeling. VerDate Sep<11>2014 17:33 Mar 12, 2024 Jkt 262001 Dated: March 8, 2024. Lauren K. Roth, Associate Commissioner for Policy. [FR Doc. 2024–05298 Filed 3–12–24; 8:45 am] BILLING CODE 4164–01–P DEPARTMENT OF HEALTH AND HUMAN SERVICES Food and Drug Administration [Docket No. FDA–2021–D–1158] Select Updates for the Premarket Cybersecurity Guidance: Section 524B of the Federal Food, Drug, and Cosmetic Act; Draft Guidance for Industry and Food and Drug Administration Staff; Availability AGENCY: Food and Drug Administration, HHS. ACTION: Notice of availability. The Food and Drug Administration (FDA or Agency) is announcing the availability of the draft guidance entitled ‘‘Select Updates for the Premarket Cybersecurity Guidance: Section 524B of the FD&C Act.’’ This draft guidance proposes select updates to the final guidance ‘‘Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions.’’ This draft guidance, when finalized, will identify the information FDA generally considers to be necessary for cyber devices to support obligations under the new amendments to the Federal Food, Drug, and Cosmetic Act (FD&C Act) for ensuring cybersecurity of devices. This draft guidance is not final nor is it for implementation at this time. DATES: Submit either electronic or written comments on the draft guidance by May 13, 2024 to ensure that the Agency considers your comment on this draft guidance before it begins work on the final version of the guidance. ADDRESSES: You may submit comments on any guidance at any time as follows: SUMMARY: Electronic Submissions Submit electronic comments in the following way: • Federal eRulemaking Portal: https://www.regulations.gov. Follow the instructions for submitting comments. Comments submitted electronically, including attachments, to https:// www.regulations.gov will be posted to the docket unchanged. Because your comment will be made public, you are solely responsible for ensuring that your comment does not include any confidential information that you or a third party may not wish to be posted, such as medical information, your or PO 00000 Frm 00051 Fmt 4703 Sfmt 4703 18421 anyone else’s Social Security number, or confidential business information, such as a manufacturing process. Please note that if you include your name, contact information, or other information that identifies you in the body of your comments, that information will be posted on https://www.regulations.gov. • If you want to submit a comment with confidential information that you do not wish to be made available to the public, submit the comment as a written/paper submission and in the manner detailed (see ‘‘Written/Paper Submissions’’ and ‘‘Instructions’’). Written/Paper Submissions Submit written/paper submissions as follows: • Mail/Hand Delivery/Courier (for written/paper submissions): Dockets Management Staff (HFA–305), Food and Drug Administration, 5630 Fishers Lane, Rm. 1061, Rockville, MD 20852. • For written/paper comments submitted to the Dockets Management Staff, FDA will post your comment, as well as any attachments, except for information submitted, marked and identified, as confidential, if submitted as detailed in ‘‘Instructions.’’ Instructions: All submissions received must include the Docket No. FDA– 2021–D–1158 for ‘‘Select Updates for the Premarket Cybersecurity Guidance: Section 524B of the FD&C Act.’’ Received comments will be placed in the docket and, except for those submitted as ‘‘Confidential Submissions,’’ publicly viewable at https://www.regulations.gov or at the Dockets Management Staff between 9 a.m. and 4 p.m., Monday through Friday, 240–402–7500. • Confidential Submissions—To submit a comment with confidential information that you do not wish to be made publicly available, submit your comments only as a written/paper submission. You should submit two copies total. One copy will include the information you claim to be confidential with a heading or cover note that states ‘‘THIS DOCUMENT CONTAINS CONFIDENTIAL INFORMATION.’’ The Agency will review this copy, including the claimed confidential information, in its consideration of comments. The second copy, which will have the claimed confidential information redacted/blacked out, will be available for public viewing and posted on https://www.regulations.gov. Submit both copies to the Dockets Management Staff. If you do not wish your name and contact information to be made publicly available, you can provide this information on the cover sheet and not in the body of your comments and you E:\FR\FM\13MRN1.SGM 13MRN1 18422 Federal Register / Vol. 89, No. 50 / Wednesday, March 13, 2024 / Notices lotter on DSK11XQN23PROD with NOTICES1 must identify this information as ‘‘confidential.’’ Any information marked as ‘‘confidential’’ will not be disclosed except in accordance with 21 CFR 10.20 and other applicable disclosure law. For more information about FDA’s posting of comments to public dockets, see 80 FR 56469, September 18, 2015, or access the information at: https:// www.govinfo.gov/content/pkg/FR-201509-18/pdf/2015-23389.pdf. Docket: For access to the docket to read background documents or the electronic and written/paper comments received, go to https:// www.regulations.gov and insert the docket number, found in brackets in the heading of this document, into the ‘‘Search’’ box and follow the prompts and/or go to the Dockets Management Staff, 5630 Fishers Lane, Rm. 1061, Rockville, MD 20852, 240–402–7500. You may submit comments on any guidance at any time (see 21 CFR 10.115(g)(5)). An electronic copy of the guidance document is available for download from the internet. See the SUPPLEMENTARY INFORMATION section for information on electronic access to the guidance. Submit written requests for a single hard copy of the draft guidance document entitled ‘‘Select Updates for the Premarket Cybersecurity Guidance: Section 524B of the FD&C Act’’ to the Office of Policy, Center for Devices and Radiological Health, Food and Drug Administration, 10903 New Hampshire Ave., Bldg. 66, Rm. 5431, Silver Spring, MD 20993–0002. Send one selfaddressed adhesive label to assist that office in processing your request. FOR FURTHER INFORMATION CONTACT: Suzanne Schwartz, Center for Devices and Radiological Health, Food and Drug Administration, 10903 New Hampshire Ave., Bldg. 66, Rm. 5410, Silver Spring, MD 20993–0002, 301–796–6937; or James Myers, Center for Biologics Evaluation and Research, Food and Drug Administration, 10903 New Hampshire Ave., Bldg. 71, Rm. 7301, Silver Spring, MD 20993, 240–402– 7911. SUPPLEMENTARY INFORMATION: I. Background Section 3305 of the Food and Drug Omnibus Reform Act of 2022 (FDORA), enacted on December 29, 2022, added section 524B ‘‘Ensuring Cybersecurity of Medical Devices’’ to the FD&C Act. Under section 524B(a) of the FD&C Act (21 U.S.C. 360n-2(a)), a person who submits a 510(k), premarket approval application (PMA), product development protocol (PDP), De Novo, or humanitarian device exemption (HDE) for a device that meets the definition of a cyber device, as defined under section 524B(c) of the FD&C Act, is required to submit information to ensure that cyber devices meet the cybersecurity requirements under section 524B(b) of the FD&C Act. FDA is proposing to selectively update the final guidance ‘‘Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions.’’ This draft guidance, when finalized, will identify the information FDA generally considers to be necessary to support obligations under section 524B of the FD&C Act. Specifically, this draft guidance discusses who is required to comply with section 524B, the devices subject to section 524B, and the documentation recommendations for applicable premarket submissions. Additionally, FDA provides recommendations regarding premarket submissions for changes to cyber devices that had been previously authorized by FDA through 510(k), De Novo, HDE, PDP, and PMA submission pathways, and that require premarket submission. This draft guidance also discusses FDA’s review of whether there is a reasonable assurance that the device and related systems are cybersecure for marketing authorizations submitted for cyber devices. This draft guidance is being issued consistent with FDA’s good guidance practices regulation (21 CFR 10.115). The draft guidance, when finalized, will represent the current thinking of FDA on ‘‘Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions.’’ It does not establish any rights for any person and is not binding on FDA or the public. You can use an alternative approach if it satisfies the requirements of the applicable statutes and regulations. II. Electronic Access Persons interested in obtaining a copy of the draft guidance may do so by downloading an electronic copy from the internet. A search capability for all Center for Devices and Radiological Health guidance documents is available at https://www.fda.gov/medical-devices/ device-advice-comprehensiveregulatory-assistance/guidancedocuments-medical-devices-andradiation-emitting-products. This guidance document is also available at https://www.regulations.gov, https:// www.fda.gov/regulatory-information/ search-fda-guidance-documents, or https://www.fda.gov/vaccines-bloodbiologics/guidance-complianceregulatory-information-biologics. Persons unable to download an electronic copy of ‘‘Select Updates for the Premarket Cybersecurity Guidance: Section 524B of the FD&C Act’’ may send an email request to CDRHGuidance@fda.hhs.gov to receive an electronic copy of the document. Please use the document number GUI00001825 and complete title to identify the guidance you are requesting. III. Paperwork Reduction Act of 1995 While this guidance contains no new collection of information, it does refer to previously approved FDA collections of information. The previously approved collections of information are subject to review by the Office of Management and Budget (OMB) under the Paperwork Reduction Act of 1995 (PRA) (44 U.S.C. 3501–3521). The collections of information in the following table have been approved by OMB: OMB control No. 21 CFR part; guidance; or FDA form Topic 807, subpart E .......................................... 814, subparts A through E ....................... 814, subpart H .......................................... 812 ............................................................ 860, subpart D .......................................... 820 ............................................................ Premarket notification .................................................................................................. Premarket approval ...................................................................................................... Humanitarian Use Devices; Humanitarian Device Exemption .................................... Investigational Device Exemption ................................................................................ De Novo classification process .................................................................................... Current Good Manufacturing Practice (CGMP); Quality System (QS) Regulation ..... VerDate Sep<11>2014 17:33 Mar 12, 2024 Jkt 262001 PO 00000 Frm 00052 Fmt 4703 Sfmt 4703 E:\FR\FM\13MRN1.SGM 13MRN1 0910–0120 0910–0231 0910–0332 0910–0078 0910–0844 0910–0073 Federal Register / Vol. 89, No. 50 / Wednesday, March 13, 2024 / Notices Dated: March 8, 2024. Lauren K. Roth, Associate Commissioner for Policy. [FR Doc. 2024–05295 Filed 3–12–24; 8:45 am] BILLING CODE 4164–01–P DEPARTMENT OF HEALTH AND HUMAN SERVICES Food and Drug Administration [Docket Nos. FDA–2019–E–5660 and FDA– 2019–E–5661] Determination of Regulatory Review Period for Purposes of Patent Extension; DAURISMO AGENCY: Food and Drug Administration, HHS. ACTION: Notice. The Food and Drug Administration (FDA or the Agency) has determined the regulatory review period for DAURISMO and is publishing this notice of that determination as required by law. FDA has made the determination because of the submission of applications to the Director of the U.S. Patent and Trademark Office (USPTO), Department of Commerce, for the extension of patents which claims that human drug product. DATES: Anyone with knowledge that any of the dates as published (see SUPPLEMENTARY INFORMATION) are incorrect may submit either electronic or written comments and ask for a redetermination by May 13, 2024. Furthermore, any interested person may petition FDA for a determination regarding whether the applicant for extension acted with due diligence during the regulatory review period by September 9, 2024. See ‘‘Petitions’’ in the SUPPLEMENTARY INFORMATION section for more information. ADDRESSES: You may submit comments as follows. Please note that late, untimely filed comments will not be considered. The https:// www.regulations.gov electronic filing system will accept comments until 11:59 p.m. Eastern Time at the end of May 13, 2024. Comments received by mail/hand delivery/courier (for written/ paper submissions) will be considered timely if they are received on or before that date. lotter on DSK11XQN23PROD with NOTICES1 SUMMARY: Electronic Submissions Submit electronic comments in the following way: • Federal eRulemaking Portal: https://www.regulations.gov. Follow the instructions for submitting comments. Comments submitted electronically, VerDate Sep<11>2014 17:33 Mar 12, 2024 Jkt 262001 including attachments, to https:// www.regulations.gov will be posted to the docket unchanged. Because your comment will be made public, you are solely responsible for ensuring that your comment does not include any confidential information that you or a third party may not wish to be posted, such as medical information, your or anyone else’s Social Security number, or confidential business information, such as a manufacturing process. Please note that if you include your name, contact information, or other information that identifies you in the body of your comments, that information will be posted on https://www.regulations.gov. • If you want to submit a comment with confidential information that you do not wish to be made available to the public, submit the comment as a written/paper submission and in the manner detailed (see ‘‘Written/Paper Submissions’’ and ‘‘Instructions’’). Written/Paper Submissions Submit written/paper submissions as follows: • Mail/Hand Delivery/Courier (for written/paper submissions): Dockets Management Staff (HFA–305), Food and Drug Administration, 5630 Fishers Lane, Rm. 1061, Rockville, MD 20852. • For written/paper comments submitted to the Dockets Management Staff, FDA will post your comment, as well as any attachments, except for information submitted, marked and identified, as confidential, if submitted as detailed in ‘‘Instructions.’’ Instructions: All submissions received must include the Docket Nos. FDA– 2019–E–5660 and FDA–2019–E–5661 for ‘‘Determination of Regulatory Review Period for Purposes of Patent Extension; DAURISMO.’’ Received comments, those filed in a timely manner (see ADDRESSES), will be placed in the docket and, except for those submitted as ‘‘Confidential Submissions,’’ publicly viewable at https://www.regulations.gov or at the Dockets Management Staff between 9 a.m. and 4 p.m., Monday through Friday, 240–402–7500. • Confidential Submissions—To submit a comment with confidential information that you do not wish to be made publicly available, submit your comments only as a written/paper submission. You should submit two copies total. One copy will include the information you claim to be confidential with a heading or cover note that states ‘‘THIS DOCUMENT CONTAINS CONFIDENTIAL INFORMATION.’’ The Agency will review this copy, including the claimed confidential information, in its consideration of comments. The PO 00000 Frm 00053 Fmt 4703 Sfmt 4703 18423 second copy, which will have the claimed confidential information redacted/blacked out, will be available for public viewing and posted on https://www.regulations.gov. Submit both copies to the Dockets Management Staff. If you do not wish your name and contact information to be made publicly available, you can provide this information on the cover sheet and not in the body of your comments and you must identify this information as ‘‘confidential.’’ Any information marked as ‘‘confidential’’ will not be disclosed except in accordance with § 10.20 (21 CFR 10.20) and other applicable disclosure law. For more information about FDA’s posting of comments to public dockets, see 80 FR 56469, September 18, 2015, or access the information at: https:// www.govinfo.gov/content/pkg/FR-201509-18/pdf/2015-23389.pdf. Docket: For access to the docket to read background documents or the electronic and written/paper comments received, go to https:// www.regulations.gov and insert the docket number, found in brackets in the heading of this document, into the ‘‘Search’’ box and follow the prompts and/or go to the Dockets Management Staff, 5630 Fishers Lane, Rm. 1061, Rockville, MD 20852, 240–402–7500. FOR FURTHER INFORMATION CONTACT: Beverly Friedman, Office of Regulatory Policy, Food and Drug Administration, 10903 New Hampshire Ave., Bldg. 51, Rm. 6250, Silver Spring, MD 20993, 301–796–3600. SUPPLEMENTARY INFORMATION: I. Background The Drug Price Competition and Patent Term Restoration Act of 1984 (Pub. L. 98–417) and the Generic Animal Drug and Patent Term Restoration Act (Pub. L. 100–670) generally provide that a patent may be extended for a period of up to 5 years so long as the patented item (human drug or biological product, animal drug product, medical device, food additive, or color additive) was subject to regulatory review by FDA before the item was marketed. Under these acts, a product’s regulatory review period forms the basis for determining the amount of extension an applicant may receive. A regulatory review period consists of two periods of time: a testing phase and an approval phase. For human drug products, the testing phase begins when the exemption to permit the clinical investigations of the drug becomes effective and runs until the approval phase begins. The approval phase starts E:\FR\FM\13MRN1.SGM 13MRN1

Agencies

[Federal Register Volume 89, Number 50 (Wednesday, March 13, 2024)]
[Notices]
[Pages 18421-18423]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2024-05295]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Food and Drug Administration

[Docket No. FDA-2021-D-1158]


Select Updates for the Premarket Cybersecurity Guidance: Section 
524B of the Federal Food, Drug, and Cosmetic Act; Draft Guidance for 
Industry and Food and Drug Administration Staff; Availability

AGENCY: Food and Drug Administration, HHS.

ACTION: Notice of availability.

-----------------------------------------------------------------------

SUMMARY: The Food and Drug Administration (FDA or Agency) is announcing 
the availability of the draft guidance entitled ``Select Updates for 
the Premarket Cybersecurity Guidance: Section 524B of the FD&C Act.'' 
This draft guidance proposes select updates to the final guidance 
``Cybersecurity in Medical Devices: Quality System Considerations and 
Content of Premarket Submissions.'' This draft guidance, when 
finalized, will identify the information FDA generally considers to be 
necessary for cyber devices to support obligations under the new 
amendments to the Federal Food, Drug, and Cosmetic Act (FD&C Act) for 
ensuring cybersecurity of devices. This draft guidance is not final nor 
is it for implementation at this time.

DATES: Submit either electronic or written comments on the draft 
guidance by May 13, 2024 to ensure that the Agency considers your 
comment on this draft guidance before it begins work on the final 
version of the guidance.

ADDRESSES: You may submit comments on any guidance at any time as 
follows:

Electronic Submissions

    Submit electronic comments in the following way:
     Federal eRulemaking Portal: https://www.regulations.gov. 
Follow the instructions for submitting comments. Comments submitted 
electronically, including attachments, to https://www.regulations.gov 
will be posted to the docket unchanged. Because your comment will be 
made public, you are solely responsible for ensuring that your comment 
does not include any confidential information that you or a third party 
may not wish to be posted, such as medical information, your or anyone 
else's Social Security number, or confidential business information, 
such as a manufacturing process. Please note that if you include your 
name, contact information, or other information that identifies you in 
the body of your comments, that information will be posted on https://www.regulations.gov.
     If you want to submit a comment with confidential 
information that you do not wish to be made available to the public, 
submit the comment as a written/paper submission and in the manner 
detailed (see ``Written/Paper Submissions'' and ``Instructions'').

Written/Paper Submissions

    Submit written/paper submissions as follows:
     Mail/Hand Delivery/Courier (for written/paper 
submissions): Dockets Management Staff (HFA-305), Food and Drug 
Administration, 5630 Fishers Lane, Rm. 1061, Rockville, MD 20852.
     For written/paper comments submitted to the Dockets 
Management Staff, FDA will post your comment, as well as any 
attachments, except for information submitted, marked and identified, 
as confidential, if submitted as detailed in ``Instructions.''
    Instructions: All submissions received must include the Docket No. 
FDA-2021-D-1158 for ``Select Updates for the Premarket Cybersecurity 
Guidance: Section 524B of the FD&C Act.'' Received comments will be 
placed in the docket and, except for those submitted as ``Confidential 
Submissions,'' publicly viewable at https://www.regulations.gov or at 
the Dockets Management Staff between 9 a.m. and 4 p.m., Monday through 
Friday, 240-402-7500.
     Confidential Submissions--To submit a comment with 
confidential information that you do not wish to be made publicly 
available, submit your comments only as a written/paper submission. You 
should submit two copies total. One copy will include the information 
you claim to be confidential with a heading or cover note that states 
``THIS DOCUMENT CONTAINS CONFIDENTIAL INFORMATION.'' The Agency will 
review this copy, including the claimed confidential information, in 
its consideration of comments. The second copy, which will have the 
claimed confidential information redacted/blacked out, will be 
available for public viewing and posted on https://www.regulations.gov. 
Submit both copies to the Dockets Management Staff. If you do not wish 
your name and contact information to be made publicly available, you 
can provide this information on the cover sheet and not in the body of 
your comments and you

[[Page 18422]]

must identify this information as ``confidential.'' Any information 
marked as ``confidential'' will not be disclosed except in accordance 
with 21 CFR 10.20 and other applicable disclosure law. For more 
information about FDA's posting of comments to public dockets, see 80 
FR 56469, September 18, 2015, or access the information at: https://www.govinfo.gov/content/pkg/FR-2015-09-18/pdf/2015-23389.pdf.
    Docket: For access to the docket to read background documents or 
the electronic and written/paper comments received, go to https://www.regulations.gov and insert the docket number, found in brackets in 
the heading of this document, into the ``Search'' box and follow the 
prompts and/or go to the Dockets Management Staff, 5630 Fishers Lane, 
Rm. 1061, Rockville, MD 20852, 240-402-7500.
    You may submit comments on any guidance at any time (see 21 CFR 
10.115(g)(5)).
    An electronic copy of the guidance document is available for 
download from the internet. See the SUPPLEMENTARY INFORMATION section 
for information on electronic access to the guidance. Submit written 
requests for a single hard copy of the draft guidance document entitled 
``Select Updates for the Premarket Cybersecurity Guidance: Section 524B 
of the FD&C Act'' to the Office of Policy, Center for Devices and 
Radiological Health, Food and Drug Administration, 10903 New Hampshire 
Ave., Bldg. 66, Rm. 5431, Silver Spring, MD 20993-0002. Send one self-
addressed adhesive label to assist that office in processing your 
request.

FOR FURTHER INFORMATION CONTACT: Suzanne Schwartz, Center for Devices 
and Radiological Health, Food and Drug Administration, 10903 New 
Hampshire Ave., Bldg. 66, Rm. 5410, Silver Spring, MD 20993-0002, 301-
796-6937; or James Myers, Center for Biologics Evaluation and Research, 
Food and Drug Administration, 10903 New Hampshire Ave., Bldg. 71, Rm. 
7301, Silver Spring, MD 20993, 240-402-7911.

SUPPLEMENTARY INFORMATION:

I. Background

    Section 3305 of the Food and Drug Omnibus Reform Act of 2022 
(FDORA), enacted on December 29, 2022, added section 524B ``Ensuring 
Cybersecurity of Medical Devices'' to the FD&C Act. Under section 
524B(a) of the FD&C Act (21 U.S.C. 360n-2(a)), a person who submits a 
510(k), premarket approval application (PMA), product development 
protocol (PDP), De Novo, or humanitarian device exemption (HDE) for a 
device that meets the definition of a cyber device, as defined under 
section 524B(c) of the FD&C Act, is required to submit information to 
ensure that cyber devices meet the cybersecurity requirements under 
section 524B(b) of the FD&C Act.
    FDA is proposing to selectively update the final guidance 
``Cybersecurity in Medical Devices: Quality System Considerations and 
Content of Premarket Submissions.'' This draft guidance, when 
finalized, will identify the information FDA generally considers to be 
necessary to support obligations under section 524B of the FD&C Act. 
Specifically, this draft guidance discusses who is required to comply 
with section 524B, the devices subject to section 524B, and the 
documentation recommendations for applicable premarket submissions. 
Additionally, FDA provides recommendations regarding premarket 
submissions for changes to cyber devices that had been previously 
authorized by FDA through 510(k), De Novo, HDE, PDP, and PMA submission 
pathways, and that require premarket submission. This draft guidance 
also discusses FDA's review of whether there is a reasonable assurance 
that the device and related systems are cybersecure for marketing 
authorizations submitted for cyber devices.
    This draft guidance is being issued consistent with FDA's good 
guidance practices regulation (21 CFR 10.115). The draft guidance, when 
finalized, will represent the current thinking of FDA on 
``Cybersecurity in Medical Devices: Quality System Considerations and 
Content of Premarket Submissions.'' It does not establish any rights 
for any person and is not binding on FDA or the public. You can use an 
alternative approach if it satisfies the requirements of the applicable 
statutes and regulations.

II. Electronic Access

    Persons interested in obtaining a copy of the draft guidance may do 
so by downloading an electronic copy from the internet. A search 
capability for all Center for Devices and Radiological Health guidance 
documents is available at https://www.fda.gov/medical-devices/device-advice-comprehensive-regulatory-assistance/guidance-documents-medical-devices-and-radiation-emitting-products. This guidance document is also 
available at https://www.regulations.gov, https://www.fda.gov/regulatory-information/search-fda-guidance-documents, or https://www.fda.gov/vaccines-blood-biologics/guidance-compliance-regulatory-information-biologics. Persons unable to download an electronic copy of 
``Select Updates for the Premarket Cybersecurity Guidance: Section 524B 
of the FD&C Act'' may send an email request to [email protected] to receive an electronic copy of the document. 
Please use the document number GUI00001825 and complete title to 
identify the guidance you are requesting.

III. Paperwork Reduction Act of 1995

    While this guidance contains no new collection of information, it 
does refer to previously approved FDA collections of information. The 
previously approved collections of information are subject to review by 
the Office of Management and Budget (OMB) under the Paperwork Reduction 
Act of 1995 (PRA) (44 U.S.C. 3501-3521). The collections of information 
in the following table have been approved by OMB:

------------------------------------------------------------------------
 21 CFR part; guidance; or FDA                              OMB control
              form                        Topic                 No.
------------------------------------------------------------------------
807, subpart E.................  Premarket notification.       0910-0120
814, subparts A through E......  Premarket approval.....       0910-0231
814, subpart H.................  Humanitarian Use              0910-0332
                                  Devices; Humanitarian
                                  Device Exemption.
812............................  Investigational Device        0910-0078
                                  Exemption.
860, subpart D.................  De Novo classification        0910-0844
                                  process.
820............................  Current Good                  0910-0073
                                  Manufacturing Practice
                                  (CGMP); Quality System
                                  (QS) Regulation.
------------------------------------------------------------------------



[[Page 18423]]

    Dated: March 8, 2024.
Lauren K. Roth,
Associate Commissioner for Policy.
[FR Doc. 2024-05295 Filed 3-12-24; 8:45 am]
BILLING CODE 4164-01-P

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.