> For the complete documentation index, see [llms.txt](https://helm.docs.medcrypt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://helm.docs.medcrypt.com/~/changes/KjixZskptrAaNWiTYnvj/ensure-fda-readiness/understand-new-fda-cybersecurity-requirements-for-cyber-devices/is-my-device-a-cyber-device.md).

# Is my device a cyber device?

According to the [FDA medical device cybersecurity FAQS](https://www.fda.gov/medical-devices/digital-health-center-excellence/cybersecurity-medical-devices-frequently-asked-questions-faqs) as of October 12, 2023:

> Section 524B(c) of the FD\&C Act defines "cyber device" as a device that (1) includes software validated, installed, or authorized by the sponsor as a device or in a device, (2) has the ability to connect to the internet, and (3) contains any such technological characteristics validated, installed, or authorized by the sponsor that could be vulnerable to the cybersecurity threats. If manufacturers are unsure as to whether their device is a cyber device, they may contact the FDA.

This means that if you device has an electronic interface of any type, such as wi-fi or USB, regardless of whether it was intended to be connected to the internet or not, you need to provide proof that the device cannot be connected to the internet. 

{% hint style="info" %}
**Medcrypt expert tip:**\
Your device is **considered to be connectable unless you can prove otherwise** via threat modeling and a Secure Product Development Framework. **If you didn't design it specifically to not be connected, then it can be.** \
\
If, in your eSTAR submission, you have a USB port that you do not report, but the FDA reviewer does a quick search for USB and finds this discrepancy, they will put an automatic hold on your submission. \
\
**Don't feel comfortable going this alone?** \
You don't have to! [Contact us](mailto:info@medcrypt.com) so we can [optimize your FDA readiness](https://www.medcrypt.com/services/fda-readiness).
{% endhint %}

Risks increase if the device contains one or more of these interfaces:

* Wired: USB, ethernet, RF, inductive, cloud, etc.
* Wireless: wi-fi, Bluetooth, RF, inductive, cloud, etc.

Cybersecurity considerations apply for the entire system, not just the end device. Examples include:

* Software update infrastructure
* Cloud applications
* Commercial devices (phones, tablets, computers, etc.)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://helm.docs.medcrypt.com/~/changes/KjixZskptrAaNWiTYnvj/ensure-fda-readiness/understand-new-fda-cybersecurity-requirements-for-cyber-devices/is-my-device-a-cyber-device.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.