This is for historical reference only. A final guidance was issued 2-Oct-2014 and is posted as well.
FDA issued a draft guidance “Content of Premarket Submissions for Management of Cybersecurity in Medical Devices” dated June 14, 2013. Comments on this document should be submitted within 90 days at www.regulations.gov or in writing to FDA 5630 Fishers Lane, Room 1061, Rockville, MD 20852.
This guidance defines cybersecurity information requested by FDA in premarket submissions. It recommends that manufacturers provide justification for the security measures chosen, that they consider availability so security measures do not impede urgent medical actions. It also requests in the submission identification of cybersecurity hazards, design considerations, and their control measures, a trace matrix for this, a plan for providing validated updates and patches, documentation to demonstrate malware will not be present in the software distributed, and instructions/labeling related to recommended antivirus software and firewalls appropriate for the intended usage environment.
The full guidance is at the link provided.