Definition of a "cyber device"

Section 524B(c) of the FD&C Act defines a 'cyber device' through three cumulative conditions: it includes software validated, installed, or authorised by the sponsor; it has the ability to connect to the internet; and it has technological characteristics that could be vulnerable to cybersecurity threats. All three must be met. In practice the connectivity prong catches most modern devices — Bluetooth, Wi-Fi, cellular, a USB data path, or a hospital-network interface typically qualifies — so the safe default is to treat any software-driven connected device as in scope until documented otherwise.