Is FDA Expanding Its Cybersecurity Oversight? What Medical Device Manufacturers Should Know About the Proposed Countering CCP Act

Cybersecurity has become one of the fastest-evolving areas of medical device regulation. While the U.S. FDA already requires cybersecurity documentation for many connected medical devices submitted after March 2023, lawmakers are now proposing legislation that could significantly expand FDA's oversight beyond new product submissions.

Recently, Senator Tom Cotton introduced the Countering Chinese Cyberthreats for Patients (Countering CCP) Act, a bill that would require the FDA and the Cybersecurity and Infrastructure Security Agency (CISA) to conduct a retrospective cybersecurity review of certain Chinese-manufactured network-connected medical devices already in use throughout the United States. If cybersecurity risks are identified, the FDA would be authorized to require recalls of affected devices.

Why Was This Bill Introduced?

The proposal follows growing concerns over cybersecurity vulnerabilities in connected medical devices, particularly after the FDA recalled certain patient monitoring devices manufactured by Contec Medical Systems due to cybersecurity risks. That incident highlighted how software vulnerabilities may affect not only patient data privacy but also device functionality and patient safety.

How Does This Relate to Current FDA Requirements?

It is important to distinguish between existing FDA regulations and this proposed legislation.

Since March 29, 2023, Section 524B of the Federal Food, Drug, and Cosmetic Act has required manufacturers of applicable "cyber devices" to provide cybersecurity information as part of their FDA premarket submissions. Depending on the device, this may include:

• Secure Product Development Framework (SPDF)

• Software Bill of Materials (SBOM)

• Vulnerability management processes

• Security update and patching plans

• Cybersecurity risk management documentation

These requirements already apply to many newly submitted connected medical devices.

The proposed Countering CCP Act would go a step further by directing the FDA to review certain legacy devices that entered the market before these cybersecurity requirements took effect, specifically focusing on network-connected devices manufactured in China.

Why This Matters for the Broader Medical Device Industry

Although the bill specifically targets certain Chinese-manufactured devices, its broader significance extends beyond any single country.

From a regulatory perspective, the proposal signals three important trends:

• Cybersecurity is increasingly being treated as a core patient safety issue rather than simply an IT concern.

• Regulatory expectations are expanding beyond premarket review toward greater post-market cybersecurity oversight.

• Software transparency, supply chain visibility, and ongoing vulnerability management are becoming increasingly important throughout the device lifecycle.

• 
  

Expert Insight

At Provision Consulting Group, we view this proposed legislation as another indication that cybersecurity is becoming a long-term regulatory priority—not only during FDA submissions, but throughout the entire lifecycle of a medical device.

Manufacturers developing connected medical devices should not wait for new legislation before strengthening their cybersecurity strategy. Preparing comprehensive cybersecurity documentation, maintaining software transparency, and implementing robust post-market vulnerability management will likely become increasingly important regardless of future legislative outcomes.

While the Countering CCP Act has not been enacted into law, it reflects the direction policymakers and regulators are moving. Companies that proactively build cybersecurity into both product development and regulatory strategy will be better positioned to navigate future FDA expectations and evolving global regulatory requirements.

Sources

1. U.S. Senate – Official Press ReleaseCotton Introduces Bill to Protect Americans from Chinese-Made Medical Deviceshttps://www.cotton.senate.gov/news/press-releases/cotton-introduces-bill-to-protect-americans-from-chinese-made-medical-devices 

2. U.S. Senate – Official Letter to FDACotton to FDA: Investigate Dangerous Chinese-Manufactured Medical Deviceshttps://www.cotton.senate.gov/news/press-releases/cotton-to-fda-investigate-dangerous-chinese-manufactured-medical-devices 

3. U.S. FDA – Official Cybersecurity GuidanceCybersecurity | Digital Health Center of Excellencehttps://www.fda.gov/medical-devices/digital-health-center-excellence/cybersecurity 

4. U.S. FDA – Medical Device Safety Communicationshttps://www.fda.gov/medical-devices/medical-device-safety