Singapore’s Health Sciences Authority (HSA) published the finalized Best Practices Guide for Medical Device Cybersecurity in August 2026. This Guide outlines cybersecurity recommendations for medical device manufacturers and healthcare providers. The Guide is aimed at keeping devices secure across their entire Total Product Life Cycle.
The Guide focuses on three core principles: shared responsibility between manufacturers and healthcare providers, transparency and communication, and secure-by-design. Its recommendations follow the device’s full lifecycle. Pre-market development comes first, which covers security feature design, risk management, security assessment and testing, user information, post-market planning, and a Software Bill of Materials. From there, the Guide addresses three later stages: post-market support, limited support, and end of support. Across these stages, responsibility for security gradually shifts from the manufacturer to the healthcare provider as the device ages.
Manufacturers and healthcare providers should consult the finalized guide to understand and apply these best practices throughout a device’s lifespan.