Confirm Support From Installation to Retirement Before You Buy

Use this before purchase and again at every contract renewal, to confirm that the vendor will support the fleet from installation to retirement. HTM and security own it, with procurement; “Manufacturers Should Build Devices to Be Managed as a Fleet” works it on the smart infusion pump fleet. Use it for any fleet the institution will support for years: ultrasound systems, anesthesia workstations, hemodialysis machines, smart beds, or point-of-care glucose meters.

FDA’s premarket cybersecurity guidance (current edition dated February 3, 2026; substance finalized June 27, 2025) recommends that manufacturers state the level of support and the end-of-support date for each software component in the SBOM, and that labeling describe end of support with a pre-communicated process for transferring risk if the device stays in service. Ask for both in writing.

1. Get the support period and the end-of-support date for the model, its software, and its operating system, in writing.
2. Get an SBOM that shows each component’s level of support and end-of-support date. Require an updated SBOM with every release.
3. Record the written notice period before end of support, and the vendor’s process for transferring risk if devices stay in service after that date.
4. Record the vendor’s patch commitment: a regular cycle for known vulnerabilities, and out-of-cycle fixes for critical ones.
5. Record the vendor’s commitment to stay compatible with changes to the institution’s infrastructure: certificate authorities, wireless security settings, the identity provider, and the server operating systems that host gateways.
6. Confirm that parts, repair documentation, and service tools stay available to in-house HTM for the whole support period.
7. Confirm that the vendor trains HTM staff on each release that changes operation or service.
8. Confirm that the institution can back up and restore each unit’s configuration.
9. Confirm the secure decommissioning procedure: data removal, certificate revocation, and removal from inventory.
10. Confirm that the institution can retrieve all device data before a unit is retired.
11. Record the migration path to the successor model, including configuration and history.
12. Record the vendor’s contingency plan if a third-party component supplier stops supporting a component.

I treat a missing end-of-support date as the one gap that can’t go into the contract as a later commitment: without it, nobody can price the fleet’s life or plan its replacement, so the purchase waits for the date or for a signed exception. Every other gap goes into the contract as a dated commitment, or into the risk register with an owner.