Software Bill of Materials requirements
Software Bill of Materials requirements are reshaping cybersecurity obligations for Healthcare & Life Sciences companies at the device and software layer, driven primarily by the U.S. Food and Drug Administration's cybersecurity guidance under the 2022 Consolidated Appropriations Act and the U.S. Department of Health and Human Services' HIPAA Security Rule enforcement priorities. The Food and Drug Administration now requires SBOM submissions as part of premarket device submissions, and the European Medicines Agency is watching parallel EU Cyber Resilience Act obligations that will pull medical device software into scope by 2027. Compliance teams at manufacturers, hospital systems, and health IT vendors are actively mapping third-party component inventories against FDA's published SBOM format expectations before renewal cycles force the issue.
Watch
- FDA premarket submission SBOM requirements: format and completeness standards under active review
- EU Cyber Resilience Act Article 13 obligations hitting medical device software by 2027
- HHS Office for Civil Rights signaling SBOM as a HIPAA Security Rule audit consideration
- NTIA minimum elements standard: whether FDA will formally adopt or diverge in final guidance
- State-level procurement rules requiring SBOM disclosure from health IT vendors
Recent material activity in Healthcare & Life Sciences
-
CMS renews NCQA deeming authority for Medicare Advantage HMOs and PPOs for six years
On July 27, 2026, CMS approved NCQA's renewal application for Medicare Advantage deeming authority, covering Health Maintenance Organizations and Preferred Provider Organizations. The six-year term allows NCQA-accredited…
Read a full sample brief → -
ECDC publishes week 30 Communicable Disease Threats Report covering Ebola, West Nile Virus, and respiratory surveillance across EU/EEA
The European Centre for Disease Prevention and Control issued its weekly Communicable Disease Threats Report for the period 18 to 24 July 2026. The report covers active threat monitoring for Ebola, West Nile Virus, Crime…
Read a full sample brief → -
Baxter recalls single lot of Cefazolin in Dextrose Injection over cardboard particulate contamination
Baxter International announced a voluntary nationwide recall on July 24, 2026 of Lot LD175708 (expiry February 14, 2027) of Cefazolin in Dextrose Injection, USP, 2G/100mL, due to cardboard particulate matter found in sol…
Read a full sample brief → -
Baxter recalls single lot of Cefazolin in Dextrose Injection over cardboard particulate contamination
Baxter International announced a voluntary nationwide recall on July 24, 2026 of one lot of Cefazolin in Dextrose Injection, USP, 2G/100mL, due to cardboard particulate matter found in solution. The recall covers Lot LD1…
Read a full sample brief → -
FDA issues Early Alert on Boston Scientific ENROUTE carotid neuroprotection systems over arterial sheath tip separation risk
FDA's Center for Devices and Radiological Health issued an Early Alert on July 24, 2026 for specific lots of the ENROUTE Transcarotid Neuroprotection System and ENROUTE Transcarotid Neuroprotection System Plus. Boston Sc…
Read a full sample brief → -
FDA issues Early Alert on Boston Scientific ENROUTE carotid neuroprotection systems over arterial sheath tip separation risk
FDA's Center for Devices and Radiological Health issued an Early Alert on July 24, 2026 for specific lots of the ENROUTE Transcarotid Neuroprotection System and ENROUTE Transcarotid Neuroprotection System Plus. Boston Sc…
Read a full sample brief → -
FDA grants full approval to zidesamtinib for ROS1-positive NSCLC following prior TKI therapy
The FDA approved zidesamtinib (Jideytro, Nuvalent, Inc.) on July 22, 2026 for adults with locally advanced or metastatic ROS1-positive non-small cell lung cancer who had received at least one prior ROS1 tyrosine kinase i…
Read a full sample brief → -
Sunny Pharmtech recalls three lots of injectable cyclophosphamide over steel particulate contamination
The FDA published a voluntary nationwide recall by Sunny Pharmtech, Inc. on July 24, 2026, covering three lots of Cyclophosphamide for Injection, USP, in 1g/vial and 2g/vial presentations. Steel particulate matter confir…
Read a full sample brief → -
FDA classifies diabetes digital behavioral therapeutic devices into Class II under special controls
On July 24, 2026, the FDA issued a final classification order placing diabetes digital behavioral therapeutic devices into Class II with special controls. The order establishes the regulatory pathway and codified special…
Read a full sample brief → -
FDA issues five-year import debarment order against Francis Esteban Matos following federal felony conviction
On July 24, 2026, FDA issued a final debarment order barring Francis Esteban Matos from importing or offering for import any drug into the United States for five years. The order follows a federal felony conviction for c…
Read a full sample brief →