§ 360n–2. Ensuring cybersecurity of devices

864 words·~4 min read·/usc/title-21/section-360n-2

A research copy — for the controlling text, always check the official state or federal source. Not legal advice.

A person who submits an application or submission under section 360(k), 360c, 360e(c), 360e(f), or 360j(m) of this title for a device that meets the definition of a cyber device under this section shall include such information as the Secretary may require to ensure that such cyber device meets the cybersecurity requirements under subsection (b). The sponsor of an application or submission described in subsection

(a)shall— submit to the Secretary a plan to monitor, identify, and address, as appropriate, in a reasonable time, postmarket cybersecurity vulnerabilities and exploits, including coordinated vulnerability disclosure and related procedures; design, develop, and maintain processes and procedures to provide a reasonable assurance that the device and related systems are cybersecure, and make available postmarket updates and patches to the device and related systems to address— on a reasonably justified regular cycle, known unacceptable vulnerabilities; and as soon as possible out of cycle, critical vulnerabilities that could cause uncontrolled risks; provide to the Secretary a software bill of materials, including commercial, open-source, and off-the-shelf software components; and comply with such other requirements as the Secretary may require through regulation to demonstrate reasonable assurance that the device and related systems are cybersecure. In this section, the term “cyber device” means a device that— includes software validated, installed, or authorized by the sponsor as a device or in a device; has the ability to connect to the internet; and contains any such technological characteristics validated, installed, or authorized by the sponsor that could be vulnerable to cybersecurity threats. The Secretary may identify devices, or categories or types of devices, that are exempt from meeting the cybersecurity requirements established by this section and regulations promulgated pursuant to this section. The Secretary shall publish in the Federal Register, and update, as appropriate, a list of the devices, or categories or types of devices, so identified by the Secretary. ( June 25, 1938, ch. 675, § 524B , as added Pub. L. 117–328, div. FF, title III, § 3305(a) , Dec. 29, 2022 , 136 Stat. 5832 .)

Connections4 cite this · traces to 2

Cited by 4 sections · top 3

Traces to 2 documents

public-private-law