Skip to main content

Cybersecurity Requirements

This page outlines mandatory cybersecurity controls for medical device software under NMPA standards, including risk assessment, authentication, encryption, vulnerability management, and incident reporting.

Regulatory basis​

NMPA's digital health and SaMD framework is based on:

  • MDSAR 2021 general device framework applied to software
  • NMPA standalone software classification guidance (独立软件分类界定指导原则)
  • NMPA SaMD registration technical review guidance (人工智能医疗器械注册审查指导原则, 2022)
  • IEC 62304 as adopted in China's YY/T 0664 standard
Disclaimer

Content on this site is written with AI assistance and is intended as a navigation aid only. Always verify against official NMPA sources before making regulatory decisions. Not affiliated with NMPA or any Chinese Government body. Not legal or regulatory advice.