FDA premarket cybersecurity for medical devices
Sytance · Updated
FDA’s premarket cybersecurity guidance recommends information that explains the device’s security design, the risks it addresses and the tests used to check it. The submission also needs to explain how the manufacturer will manage vulnerabilities after the device is released.
Current guidance status
FDA issued the current final premarket cybersecurity guidance in February 2026, replacing the June 2025 version. The revision aligns the guidance with the Quality Management System Regulation (QMSR). Its recommendations should be distinguished from the statutory requirements in section 524B.
This document supersedes “Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions,” issued June 27, 2025.
FDA premarket cybersecurity guidance, February 2026 (original English)
The guidance addresses devices with cybersecurity risk. Software, firmware or programmable logic may introduce such risk even when the device has no internet connection. Section 524B applies to the narrower category of cyber devices defined in the FD&C Act.
Cyber device under section 524B
Section 524B applies to specified submissions for a cyber device: 510(k), PMA, product development protocol, De Novo and HDE. The law took effect on 29 March 2023. FDA’s transition policy on refusing to accept submissions ended on 1 October 2023; that date did not change when the legal requirements took effect.
Software controlled by the sponsor
The device includes software that is validated, installed or authorised by the sponsor as a device or in a device. FDA treats firmware and programmable logic as software for this analysis.
Internet connection capability
The device can connect to the internet directly or through another product. FDA’s interpretation includes indirect connections, such as a device communicating through an internet-connected computer.
Cybersecurity-threat exposure
The device contains sponsor-validated, sponsor-installed or sponsor-authorised technological characteristics that could be vulnerable to cybersecurity threats.
For a qualifying submission, section 524B requires a plan to monitor and address postmarket vulnerabilities, including coordinated vulnerability disclosure. It also requires processes and procedures to provide reasonable assurance of cybersecurity, with postmarket updates and patches, and an SBOM covering commercial, open-source and off-the-shelf software components.
Submission content
The reviewer needs to understand how a security decision was reached. If a threat model identifies unauthorised changes to therapy settings, the design should specify who may change them and the tests should check that restriction. The architecture, analysis and results need to describe the same device configuration.
FDA recommends integrating security into the quality management system. Development records should explain how security requirements influenced the design, how the implementation was checked and how unresolved issues were handled before release. Maintenance planning extends that process to later vulnerabilities and updates.
Cybersecurity risk management examines how an attacker could exploit a weakness and affect the device. If the attack could cause patient harm, the resulting hazardous situation also needs to be evaluated through safety risk management. For example, an attack that suppresses an alarm could delay a clinical response.
The risk management report should explain the assessment method and residual risk conclusion. Component support status, known vulnerabilities and unresolved software anomalies help establish whether the manufacturer can maintain protection throughout the device’s expected use.
The threat model should cover the complete device system, including external dependencies that affect its operation. Analyse how it is installed, used, updated and retired. The architecture views then show where the selected controls act on those attack paths.
Tests need to check the security requirements and the measures selected for identified threats. Code and software-composition analysis can reveal weaknesses in the implementation or its components. Fuzzing, misuse testing and penetration testing examine behaviour under malformed input or attack; choose the methods that address the device’s interfaces and risks.
User information should explain what the healthcare organisation or patient needs to do for secure operation, including configuration, updates and recovery. State the support period and any responsibilities that depend on the operating environment. The manufacturer’s cybersecurity management plan should explain how vulnerability reports and monitoring lead to an assessment, communication and timely remediation.
Common evidence
Architecture views
FDA recommends global system, multi-patient harm, updateability and patchability, and security use case views. They explain how an attack can reach the device, spread across connected systems or be addressed through an update.
SBOM
The SBOM should cover manufacturer-developed and third-party components, including purchased, licensed, open-source and upstream dependencies. For cyber devices, section 524B makes SBOM content statutory.
Known vulnerabilities
FDA expects known vulnerabilities to be identified and analysed, including vulnerabilities in third-party components and CISA Known Exploited Vulnerabilities that are relevant to the device or related systems.
Traceability
Traceability lets the reviewer follow a threat-model finding to its affected SBOM component, risk control, design requirement and test result. Residual-risk decisions should also be reflected in labelling and postmarket monitoring.
The guidance’s security-control categories help check the design systematically. For example, authenticating a user establishes an identity; authorisation determines whether that user may perform a particular clinical or maintenance action. Tests should check each decision at the interface that enforces it.
Devices outside the section 524B definition
A device without internet connectivity may still accept a software update through a local port or removable media. A tampered update can therefore create a cybersecurity risk even if the device does not meet the cyber-device definition. FDA’s broader guidance remains relevant to that risk; the recommended submission content depends on the device and submission type.