Early FDA guidance (2005) on cybersecurity management of off-the-shelf (OTS) software incorporated into network-connected medical devices. It sets out the division of responsibilities between manufacturers and healthcare facilities and the approach to operating system patching, antivirus protection, and access control. Useful for understanding the regulatory history as a predecessor of the current final cybersecurity guidance (first issued in September 2023 and since revised, including the June 2025 version).