Scope of the Guidance
The MFDS IoMT Cybersecurity Guidance (No. 2026-043) applies to all medical devices that communicate via wired or wireless interfaces including Bluetooth, Wi-Fi, cellular, and NFC. The guidance defines three device categories — standalone connected devices, network-integrated systems, and cloud-dependent devices — each with differentiated pre-market documentation and post-market monitoring requirements.
Software Bill of Materials Mandate
Manufacturers must submit a complete Software Bill of Materials (SBOM) in machine-readable format (CycloneDX or SPDX) as part of new product approval applications from 01 January 2027. For devices already on the market, SBOM submission to the MFDS product database is required within 18 months of the guidance effective date. The SBOM must enumerate all third-party components at version level, including open-source libraries.
Vulnerability Disclosure Requirements
The guidance mandates a Coordinated Vulnerability Disclosure (CVD) process with defined timelines: critical severity findings must be disclosed to MFDS and users within 30 days of confirmed identification; high severity within 60 days; medium and low severity within 90 days. Manufacturers must publish CVD contact information on their Korean-language product webpage.
Alignment with International Frameworks
The guidance references IEC 81001-5-1:2021, the IMDRF Principles and Practices for Medical Device Cybersecurity (N60), and the US FDA's 2023 Cybersecurity Guidance. MFDS has confirmed it will participate in the IMDRF Cybersecurity Working Group to harmonise future updates with international expectations.