Ministry of Health Cybersecurity Requirements for Connected Devices

1. Key takeaways

Israel’s cybersecurity requirements for connected medical devices are set out in the form of Director-General circulars of the Ministry of Health (in force since 2019). Their core consists of three sets of materials: a cybersecurity risk management file, a threat model, and evidence of a secure development life cycle (SDLC). In practice these align with the FDA cybersecurity guidance and IMDRF principles, with reference to IEC 81001-5-1. An SBOM (software bill of materials) is strongly recommended rather than mandatory. Devices deployed in hospitals additionally involve coordination with the Israel National Cyber Directorate (INCD). Cybersecurity materials do not constitute a stand-alone review threshold, but missing items trigger deficiency notices, and each round of deficiencies typically extends the timeline (practical estimate).

• The three core artefacts — risk management file, threat model and secure SDLC evidence — should be assembled before submission, not on request.
• SBOM is a strongly recommended item, and submitting one proactively reduces deficiency rounds.
• Deficiency time is not counted within the 120-day review period under Article 5, so every missing item costs calendar time.
• Hospital-deployed connected devices face an additional INCD coordination layer in procurement, outside AMAR’s jurisdiction.

2. Legal basis

The table below records the instruments behind the cybersecurity requirement, including the parent law, the referenced standards and the parallel data-protection obligations.

3. Expert insights

The positioning of Israel’s cybersecurity requirements deserves to be understood precisely: they are not a stand-alone approval condition but part of the technical documentation. That positioning produces two consequences.

Consequence one: the materials can be reused. GRZAN’s experience is that cybersecurity materials prepared for the FDA or the European Union enjoy a high reuse rate in Israel — the structure of the threat model, the security risk assessment, the penetration testing report and the SBOM is largely common. What genuinely needs local handling is the Hebrew-language user notification and the interface documentation for local medical institutions. Treating the Israeli package as a localisation layer over the existing file, rather than a fresh build, is the efficient reading of the requirement, and it keeps the technical baseline identical across markets so that updates propagate once rather than three times.

Consequence two: the price of missing items is time, not rejection. Missing cybersecurity materials usually manifest as a deficiency notice. Because Article 5 of the Regulations provides that deficiency-resolution time is not counted within the 120-day review period, every round of deficiencies stretches the actual timeline. so missing items cost calendar time twice — once for the round trip of the notice and once for the requeue after the fix — and the effect multiplies with every additional round. Submitting everything right the first time is therefore more economical than supplementing afterwards, and the savings compound when submission deadlines are commercially fixed.

The third point of interest is the superimposed INCD obligation. Connected devices deployed in hospitals, beyond device regulation, also involve cybersecurity coordination for critical infrastructure. This layer does not fall under AMAR’s jurisdiction, but it is raised during hospital procurement, and companies need answers ready at the tendering stage. Preparing a hospital-facing pack in advance — the cybersecurity explanation and the INCD coordination points — converts a procurement-stage question into a submitted document rather than a stalled deal, and it costs far less to assemble while the technical file is already open than to rebuild it mid-tender.

Finally, vulnerability management should be treated as a living process rather than a submission artefact: monitoring, assessment, patching and notification must be documented and connected to post-market vigilance, because the same lifecycle the regulator sees on paper is the one that will be examined if an incident occurs after the device is on the market.

4. Practical recommendations

• Reuse reference-country materials. Build on FDA or EU cybersecurity documentation and add the local interface and language portions specific to Israel, so the technical baseline stays identical across markets.
• Submit the SBOM together with the dossier. Although it is a recommended item, preparing it in advance reduces the number of deficiency rounds.
• Establish a closed loop for vulnerability management. Vulnerability monitoring, assessment, patching and notification processes must be documented and connected to post-market vigilance.
• Prepare a hospital-facing materials pack. Assemble the cybersecurity explanation and INCD coordination points for tenders and hospital deployments in advance (practical estimate).

5. Verification checklist

• □ The cybersecurity risk management file is complete and connected to ISO 14971 risk management
• □ The threat model has been prepared, covering network interfaces, wireless communication, cloud connectivity, removable media and update mechanisms
• □ Secure SDLC evidence is complete (security requirements, secure coding, security testing, penetration testing)
• □ An SBOM has been prepared and submitted with the application (recommended item)
• □ Vulnerability management and patch release processes are documented
• □ INCD coordination points for hospital deployment scenarios have been prepared (practical estimate)

Regulatory information verified as of 29 October 2026. The regulation names, numbers, publication dates and provisions cited in this article were checked against the official Israeli legal databases and authoritative public sources on that date; AMAR procedural documents are updated frequently, so before any formal submission the current version on the Ministry of Health website prevails.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support for the Israeli market. Our team prepares MOH-compliant dossiers, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com