1. Short title This Act may be cited as the Medical Device Cybersecurity Act of 2017 . 2. Cybersecurity for medical devices (a) In general Chapter V of the Federal Food, Drug, and Cosmetic Act ( 21 U.S.C. 351 et seq.) is amended by inserting after section 520 ( 21 U.S.C. 360j ) the following— 520A. Cybersecurity for devices (a) Definitions In this section: (1) Cyber device The term cyber device means any device that has network or Internet connectivity (such as near field communication (NFC), Bluetooth, or WiFi), connects to an external storage device or external media (such as a universal serial bus (USB) or a compact disk), or has any other cyber capability. (2) Cybersecurity fix or update The term cybersecurity fix or update means any modification to a cyber device that addresses a software, firmware, or hardware error or known vulnerability, or a security update, and does not change the therapeutic or diagnostic function of the device. (b) Transparency of risk prior to marketing (1) Report card (A) In general The Secretary, in coordination with the entities described in subparagraph (B), shall develop a report card for indicating the cybersecurity functions of cyber devices. The report card shall contain the contents described in paragraph (2) and be disclosed in accordance with paragraph (3). (B) Coordination The entities described in this subparagraph are the following: (i) The National Institute of Standards and Technology. (ii) The Secretary of Homeland Security. (iii) The National Coordination Office supporting the Networking and Information Technology Research and Development Program. (iv) The Federal Trade Commission. (v) Any other relevant agency, or cybersecurity or medical device industry group, as determined by the Secretary. (2) Contents of report card Each report card shall contain each of the following: (A) Information pertaining to all essential elements described in the most recent version of the Manufacturer Disclosure Statement for Medical Device Security, as set forth by the Healthcare