Managing Legacy Vulnerabilities: Analyzing SBOM Visibility Gaps and End-of-Support Risks in FDA Postmarket IoMT Guidance
Executive Summary
Healthcare organizations face a structural compliance and operational crisis: FDA postmarket cybersecurity guidance mandates comprehensive device lifecycle management and vulnerability disclosure, yet 99% of healthcare networks operate medical devices with critical vulnerabilities that remain untracked due to incomplete or absent software bill of materials (SBOM) documentation. This visibility gap extends institutional liability beyond device manufacturers to healthcare delivery organizations themselves, creating exposure that intersects regulatory compliance, patient safety, and operational complexity.
The convergence of end-of-support device lifecycles, CISA SBOM standardization frameworks, and FDA enforcement expectations requires healthcare institutions to rapidly establish device portfolio visibility, prioritize vulnerability remediation pathways, and implement defensible risk acceptance frameworks for devices without remediation options. Organizations must balance resource constraints against unbounded device inventories while maintaining compliant regulatory posture and clinical safety standards.
Key Finding: FDA postmarket cybersecurity guidance requires comprehensive device lifecycle management and vulnerability disclosure, yet 99% of healthcare networks operate medical devices with critical vulnerabilities untracked through incomplete or absent SBOM documentation, creating institutional regulatory exposure that extends beyond device manufacturer accountability to healthcare delivery organizations themselves.
What Happened
The healthcare cybersecurity landscape underwent significant regulatory acceleration between 2023 and 2026, driven by converging FDA guidance, CISA standardization initiatives, and systematic evidence of vulnerability visibility gaps across Internet of Medical Things (IoMT) device portfolios. The FDA established explicit postmarket cybersecurity obligations requiring healthcare delivery organizations to maintain comprehensive device vulnerability visibility, engage manufacturers in coordinated disclosure, and document risk assessments for devices operating beyond end-of-support. These requirements flow from 21 CFR Part 11 (electronic records and signatures), FDA Software as a Medical Device guidance, and postmarket management directives issued between 2023 and 2026.
The regulatory framework distinguishes manufacturer obligations—providing security patches and vulnerability notifications—from healthcare organization obligations—tracking vulnerabilities, assessing patient safety implications, and documenting defensible risk management decisions. This distinction creates institutional accountability that extends beyond vendor relationships to governance and clinical decision-making. FDA enforcement precedent establishes that healthcare organizations cannot claim ignorance of device vulnerability status as a compliance defense.
Recent threat intelligence from Claroty corroborated through sector analysis reveals that 99% of healthcare networks operate medical devices with critical vulnerabilities untracked due to incomplete or absent SBOM documentation. A software bill of materials is a formal, machine-readable inventory of all software components, libraries, and dependencies embedded in a device. Legacy medical devices—manufactured between 2010 and 2020, remaining clinically essential and financially difficult to replace—frequently predate SBOM documentation practices and lack retroactive component transparency.
End-of-support (EoS) devices—hardware and firmware combinations for which manufacturers no longer provide security patches, vulnerability notifications, or technical support—represent accelerating institutional risk. Healthcare institutions often operate EoS devices for 5–10 years beyond manufacturer support windows due to clinical necessity, capital constraints, or workflow integration complexity. Current data indicates approximately 25–40% of medical devices in active U.S. healthcare systems operate beyond manufacturer support windows.
The intersection of FDA vulnerability management requirements, CISA SBOM standardization, and documented industry visibility gaps creates a three-vector compliance challenge. Healthcare organizations must simultaneously track vulnerabilities in devices lacking manufacturer SBOM data, manage devices operating beyond end-of-support windows where no remediation pathway exists, and allocate constrained security and clinical engineering resources across unbounded device portfolios.
Why It Matters
Regulatory and Compliance Leadership
FDA postmarket guidance and enforcement precedent establish explicit organizational accountability for device vulnerability management. Regulatory violations carry consequences ranging from warning letters to injunctions and civil penalties under 21 USC § 337, which classifies failure to maintain appropriate cybersecurity controls as grounds for device adulteration findings. Healthcare organizations cannot claim manufacturer non-responsiveness as mitigation; regulatory authority expects institutional governance documenting vulnerability discovery processes, risk assessments, remediation decisions, and documented risk acceptance for devices without remediation pathways. Documentation defensibility represents the essential compliance mechanism.
Clinical and Patient Safety Leadership
Unpatched medical devices represent persistent attack surface for healthcare network intrusion. A vulnerability in networked infusion pumps, patient monitors, laboratory analyzers, or imaging systems provides threat actors entry points for network reconnaissance, lateral movement, and clinical system access. Clinical impact pathways differ from traditional IT systems where a compromised medical device may interrupt clinical workflow through denial-of-service attacks, compromise device function through firmware modification, or enable direct patient harm through therapeutic device manipulation. Attack surface concentration—a single vulnerability affecting thousands of identical devices across multiple care sites—creates epidemiological risk.
Security and IT Operations Leadership
Traditional IT asset management and vulnerability management processes assume standardized operating systems, centralized patch delivery mechanisms, and organizational control over system configurations. Medical devices operate under different constraints: heterogeneous firmware, manufacturer-controlled update mechanisms, regulatory restrictions on modifications, and clinical integration dependencies making downtime for patching logistically difficult. Incomplete SBOM documentation combined with high device counts creates detection and response challenges. Resource allocation becomes strategic problem as healthcare security teams operate under significant staffing constraints with device expertise remaining scarce.
Supply Chain and Procurement Leadership
The vulnerability visibility crisis reveals fundamental supply chain accountability gaps. Medical device vendors control vulnerability disclosure, patch provision, and SBOM documentation, yet lack direct contractual relationships with healthcare organizations in many cases. Healthcare organizations have limited leverage to enforce vendor accountability for cybersecurity practices. Long-term cost implications drive procurement strategy evolution as devices procured without SBOM requirements may require expensive retroactive engineering or manual vulnerability research to achieve compliance.
Biomedical and Clinical Engineering Leadership
Organizational response capacity depends on workforce understanding of regulatory obligations and technical feasibility boundaries. Postmarket cybersecurity governance requires biomedical engineers to participate in vulnerability assessment, risk prioritization, and remediation decision-making. This role expansion requires new technical competencies and regulatory understanding that current biomedical engineering training does not universally provide, driving need for capability development and cross-functional collaboration.
Operational Implications
Immediate (0–90 Days): Healthcare organizations must establish postmarket cybersecurity governance accountability by designating program leadership, establishing cross-functional working groups, and enumerating medical device inventory. Conduct systematic device inventory across all clinical and operational settings, categorizing by manufacturer, model, intended use, network connectivity, and end-of-support status. Establish vendor communication protocol requesting SBOM documentation in standardized format and develop organizational interpretation of FDA postmarket cybersecurity guidance to clarify institutional expectations.
Short-term (90–180 Days): Organizations should implement SBOM data consolidation and vulnerability correlation using dedicated platforms or structured databases, establishing centralized repositories normalizing SBOM data into consistent format. Systematically assess all end-of-support devices conducting risk evaluation for clinical criticality, vulnerability exposure, compensating control feasibility, and remediation cost. Initiate formal vulnerability disclosure communication with vendors for high-risk device models, documenting vendor responses and patch availability. Begin segmentation and compensating control implementation for unsupported devices and develop formal risk acceptance documentation for devices where remediation is infeasible.
Medium-term (180–365 Days): Organizations should establish formal postmarket cybersecurity governance program with charter defining organizational mission, governance structure, decision authority, and standard processes for vulnerability discovery, risk assessment, remediation decisions, and incident response. Execute systematic remediation prioritizing patches for high-severity vulnerabilities in widely deployed devices. Integrate cybersecurity requirements into device procurement practices through contractual obligations for SBOM documentation, vulnerability disclosure timelines, and extended support lifecycle. Implement or enhance medical device network monitoring capability enabling detection of abnormal device behavior and develop device-specific incident response procedures. Conduct internal audit of postmarket cybersecurity governance maturity against FDA regulatory expectations.
Long-term (365+ Days): Organizations must sustain postmarket cybersecurity governance as ongoing program with continuous vulnerability discovery, risk assessment, remediation execution, and regulatory documentation. Establish quarterly review cycles for end-of-support device risk acceptance, reassessing new vulnerability discoveries and control effectiveness. Maintain configuration management documenting patch status for each device and tracking rollback procedures. Conduct regular tabletop exercises simulating medical device compromise scenarios to identify gaps in detection, response, and communication procedures. Evolve procurement standards as vendor capabilities mature and regulatory expectations sharpen, driving market-wide adoption of cybersecurity accountability practices.
Recommended Actions
Actions are organized by organizational security maturity. Baseline controls apply across all tiers and should be treated as immediate priorities regardless of organizational size.
* Organizations with standard security tooling and general-purpose endpoint protection.
- 1 - Designate postmarket cybersecurity program lead with explicit authority for vulnerability tracking, risk assessment, and remediation prioritization. Establish cross-functional working group including security leadership, clinical engineering, biomedical engineering, IT operations, compliance, and legal representation meeting monthly.
- 2 - Conduct systematic device inventory across all clinical and operational settings, categorizing by manufacturer, model, intended use, network connectivity, and end-of-support status. Assign department owners for inventory maintenance and establish quarterly review cycles.
- 3 - Develop template communication to major device vendors requesting SBOM documentation in standardized format (CycloneDX or SPDX XML) with 30–60 day response deadline. Establish intake process for collected SBOM documentation and document gaps for devices unlikely to have retroactive SBOM provision.
- 4 - Conduct internal workshop with compliance, legal, clinical leadership, and security teams to establish organizational interpretation of FDA postmarket cybersecurity guidance, documenting understanding of organizational obligations, vulnerability severity thresholds, documentation requirements, and risk acceptance criteria.
- 5 - Brief senior leadership on regulatory compliance obligation scope, current vulnerability visibility gaps, resource requirements for comprehensive compliance, and three-year roadmap with cost estimates. Request explicit executive commitment to allocate budget for infrastructure and security team expansion.
* Organizations with dedicated security teams and vulnerability management capabilities.
- 1 - Establish centralized SBOM data repository using dedicated SBOM management platform or structured database. Normalize collected SBOM data into consistent format and establish data quality standards for component names, version precision, and dependency completeness.
- 2 - Execute systematic vulnerability correlation matching SBOM components against NVD, sector-specific threat intelligence databases, and manufacturer security advisories. Generate vulnerability summary dashboard tracking total vulnerabilities by severity, affected device count, and remediation pathway availability.
- 3 - Systematically document all devices operating beyond manufacturer support windows. Conduct risk assessment for each EoS device evaluating clinical criticality, vulnerability exposure, compensating control feasibility, and remediation cost. Classify devices into three categories: Remediation Feasible, Risk Mitigation Required, or Decommissioning Planned.
- 4 - Identify 10–20 highest-risk device models based on vulnerability severity, device prevalence, clinical impact, and manufacturer responsiveness. Initiate formal vulnerability disclosure communication requesting patch availability, SBOM documentation, and future vulnerability disclosure commitment. Document vendor responses to create audit trail demonstrating organizational accountability.
- 5 - Develop compensating control architecture for EoS or high-vulnerability devices without remediation pathway. Implement network segmentation isolating devices to trusted networks with access controls and enhanced monitoring deploying detection for device-specific attack patterns. Develop formal risk acceptance documentation for retained devices requiring executive sign-off.
* Organizations with comprehensive security programs and advanced threat detection capabilities.
- 1 - Establish formal postmarket cybersecurity governance program with charter defining organizational mission, governance structure, decision authority, meeting cadence, and standard processes for vulnerability discovery intake, risk assessment methodology, remediation decision process, documentation standards, and incident response procedures. Publish processes organizationally and train staff. Establish metrics and reporting including quarterly vulnerability summaries and remediation progress.
- 2 - Execute systematic remediation prioritizing patches for high-severity vulnerabilities in widely deployed devices where deployment is feasible. Coordinate with IT operations and clinical engineering to schedule maintenance windows, test patches in pre-production environments, and track remediation progress across device portfolio.
- 3 - Integrate cybersecurity requirements into device procurement practices establishing contractual requirements for SBOM documentation in CISA-aligned format, vendor commitment to defined vulnerability disclosure timelines, and security patches throughout device lifecycle. Develop evaluation criteria for device selection assessing vendor cybersecurity maturity and include cybersecurity cost-of-ownership in procurement assessment.
- 4 - Implement or enhance medical device network monitoring capability enabling detection of abnormal device behavior, unauthorized access attempts, and known attack patterns. Deploy deep packet inspection for device-specific protocols and implement behavioral baselines for normal device operation. Develop device-specific incident response procedures defining escalation pathways, evidence preservation, isolation, and restoration procedures. Conduct regular tabletop exercises simulating medical device compromise scenarios.
- 5 - Conduct internal audit of postmarket cybersecurity governance maturity against FDA regulatory expectations. Document compliance gaps and remediation roadmap. Compile comprehensive documentation of vulnerability discovery processes, risk assessments, remediation decisions, and governance meeting records. Consider engagement with external cybersecurity advisors for independent assessment of compliance posture.
Closing Statement
The convergence of FDA postmarket cybersecurity requirements, CISA SBOM standardization, and documented vulnerability visibility gaps across healthcare device portfolios represents a defining challenge for healthcare institutional cybersecurity governance. Unlike traditional IT cybersecurity, where centralized control and standardized platforms enable systematic vulnerability management, medical device cybersecurity requires navigation of regulatory expectations, technical infeasibility for legacy devices, and clinical operational constraints that demand pragmatic, defensible risk acceptance frameworks.
The core insight is not that perfect vulnerability remediation is possible—for many healthcare organizations, it remains technically infeasible. Rather, the insight is that regulatory compliance depends on demonstrated due diligence: systematic vulnerability discovery, formal risk assessment, documented remediation decisions, and sustained governance accountability. Organizations that institutionalize these governance practices create defensible regulatory posture even while maintaining devices with known vulnerabilities.
Healthcare organizations beginning this journey should expect multi-year implementation timelines, substantial resource investment, and necessary evolution of clinical and security team capabilities. The path forward requires executive awareness and commitment, cross-functional collaboration transcending traditional organizational silos, and acceptance that perfect vulnerability remediation will remain unattainable for some device categories.
Organizations that successfully navigate this transition will establish competitive advantage in an increasingly cybersecurity-aware healthcare procurement environment, reduce exposure to FDA enforcement action, and strengthen clinical resilience through systematic vulnerability governance. Those that defer action will face accelerating regulatory exposure and institutional risk as FDA enforcement expectations sharpen. The time for postmarket cybersecurity governance institutionalization is present, and action should begin immediately.