
The Food and Drug Administration’s policies and procedures were insufficient for handling postmarket medical device cybersecurity events, and the agency has not adequately tested its ability to respond to emergencies resulting from cybersecurity events in medical devices.