Side by side

Pick your markets. See the deltas.

Select up to five jurisdictions to put their cybersecurity expectations head to head. Click any column header to drill into the full profile.

Last updated · October 17, 2026

Status key

MandatoryStatutory or binding regulation. Non-compliance blocks market access.

GuidanceNon-statutory guidance. Typically enforced via review and registration.

EmergingFramework adopted but not yet fully enforced or in active implementation.

Filters

SBOM Required only34 / 34

Cybersecurity diligence ranking

Which regulators demand the most rigorous cybersecurity evidence?

Composite score (0-100) computed from 29 weighted requirements in the FDA translation matrix. Weightings prioritize dimensions that actually change security posture - threat modeling, SBOM/vuln mapping, testing, CVD, patching, incident reporting - over paperwork-only obligations.

#	Jurisdiction		Tier	Required / Expected	Top gaps vs FDA
1	FDA 524B FDA / CDRH	154	Tier 1 - Rigorous	24 req · 5 exp	Matches FDA rigor
2	NMPA NMPA	146	Tier 1 - Rigorous	20 req · 8 exp	Security architecture views (global / multi-patient / updateability)
3	MFDS MFDS	128	Tier 1 - Rigorous	6 req · 21 exp	Security architecture views (global / multi-patient / updateability)
4	EU MDR EC / MDCG	127	Tier 1 - Rigorous	7 req · 20 exp	Security architecture views (global / multi-patient / updateability)
5	MHRA MHRA	122	Tier 1 - Rigorous	3 req · 24 exp	Security architecture views (global / multi-patient / updateability)
6	Health Canada Health Canada	121	Tier 1 - Rigorous	3 req · 23 exp	Security architecture views (global / multi-patient / updateability)
7	Swissmedic Swissmedic	121	Tier 1 - Rigorous	3 req · 23 exp	Security architecture views (global / multi-patient / updateability)
8	TFDA TFDA	120	Tier 1 - Rigorous	3 req · 22 exp	Security architecture views (global / multi-patient / updateability)
9	HSA HSA	117	Tier 1 - Rigorous	3 req · 21 exp	SBOM tied to known vulnerabilities + support status Security architecture views (global / multi-patient / updateability)
10	PMDA PMDA / MHLW	114	Tier 1 - Rigorous	3 req · 19 exp	Machine-readable SBOM (SPDX or CycloneDX) SBOM tied to known vulnerabilities + support status Security architecture views (global / multi-patient / updateability)
11	TGA TGA	95	Tier 1 - Rigorous	3 req · 3 exp	Threat model with device-specific attack surface Machine-readable SBOM (SPDX or CycloneDX) SBOM tied to known vulnerabilities + support status
12	CDSCO CDSCO	91	Tier 1 - Rigorous	2 req · 4 exp	Threat model with device-specific attack surface Machine-readable SBOM (SPDX or CycloneDX) SBOM tied to known vulnerabilities + support status
13	AMAR AMAR / MoH	91	Tier 1 - Rigorous	2 req · 2 exp	Threat model with device-specific attack surface Machine-readable SBOM (SPDX or CycloneDX) SBOM tied to known vulnerabilities + support status
14	SFDA SFDA	86	Tier 1 - Rigorous	1 req · 4 exp	Threat model with device-specific attack surface Machine-readable SBOM (SPDX or CycloneDX) SBOM tied to known vulnerabilities + support status
15	ANVISA ANVISA	84	Tier 2 - Substantive	1 req · 3 exp	Threat model with device-specific attack surface Machine-readable SBOM (SPDX or CycloneDX) SBOM tied to known vulnerabilities + support status
16	MOHAP MOHAP / DHA / DoH	81	Tier 2 - Substantive	0 req · 3 exp	Threat model with device-specific attack surface Machine-readable SBOM (SPDX or CycloneDX) SBOM tied to known vulnerabilities + support status

Not sure how to use this? Try the journey planner to turn these scores into a sequenced submission roadmap.