The International Medical Device Regulators Forum (IMDRF) has posted a draft guidance for cybersecurity practices for legacy devices, a nod to the number of older devices that are difficult to secure. This document is a follow-up to a standing IMDRF guidance that spans the product life cycle, but which apparently left stakeholders with a few questions.