Medical device cybersecurity: FDA requirements
Section 524B, premarket submission content and expected testing: what the FDA requires from connected medical device manufacturers before they enter the US market.
Since 29 March 2023, section 524B of the Federal Food, Drug, and Cosmetic Act (FD&C Act) has made cybersecurity a legal requirement for medical devices submitted to the FDA. It applies to every premarket submission — 510(k), De Novo, PMA, HDE — for a "cyber device". Since 1 October 2023, the FDA can refuse to accept a submission whose cybersecurity content is insufficient.
For a European manufacturer, the stakes are concrete: without a complete cybersecurity file, there is no access to the US market. The good news is that most of the evidence required — risk analysis, SBOM, vulnerability management, penetration testing — also supports CE marking under the MDR and, for non-medical products, the Cyber Resilience Act.
This article summarises section 524B and the FDA guidance Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions, in its final version of February 2026, referenced at the end of this page.
What is a "cyber device"?
Section 524B covers devices that meet three criteria:
- they include software validated, installed or authorised by the sponsor as a device or in a device;
- they have the ability to connect to the internet;
- they contain technological characteristics that could be vulnerable to cybersecurity threats.
The FDA reads internet connectivity broadly: it includes any connection, intended or not, by any means — Wi-Fi, cellular, Bluetooth, USB, Ethernet, serial port. A "non-connected" device with a USB maintenance port is, in practice, often in scope.
The four legal requirements
What every cyber device manufacturer must provide in its premarket submission.
Monitor vulnerabilities
A plan to monitor, identify and address, in a reasonable time, postmarket vulnerabilities and exploits, including coordinated vulnerability disclosure (CVD) procedures.
Design and maintain securely
Processes that provide reasonable assurance that the device and related systems are cybersecure, with regular updates and out-of-cycle patches for critical vulnerabilities.
Provide an SBOM
A software bill of materials covering commercial, open-source and off-the-shelf components, with their support level and known vulnerabilities.
Meet other requirements
Any other requirement the FDA sets by regulation to demonstrate device cybersecurity, notably within the quality system (QMSR, 21 CFR 820).
What goes into the cybersecurity file
The FDA guidance details the elements expected in the submission. They fit within a Secure Product Development Framework (SPDF) built into the manufacturer's quality system.
- Threat modelling: attack surfaces, data flows and threat scenarios across the whole system, from device to cloud.
- Cybersecurity risk assessment, separate from but linked to the safety risk analysis (ISO 14971), including residual risk evaluation.
- Architecture views: global system, multi-patient harm, updatability and patchability, security use cases.
- SBOM, support level and end-of-support date of each component, analysis of known vulnerabilities.
- Security controls: authentication, authorisation, cryptography, code and data integrity, confidentiality, logging, resiliency and recovery, updatability.
- Traceability between threats, controls and tests.
- Cybersecurity testing: security requirements verification, threat mitigation testing, vulnerability testing (fuzzing, software composition analysis, static and dynamic analysis) and penetration testing, preferably by testers independent from the development team.
- User information (labeling) and a postmarket cybersecurity management plan.
Preparing your submission in five steps
An approach to start at design time: cybersecurity cannot be bolted on at the end of a project.
Qualify the device
Determine whether it is a cyber device under section 524B and map the complete system: device, applications, gateways, cloud and maintenance interfaces.
Model threats and assess risks
Build the threat model and cybersecurity risk assessment using FDA-recognised standards such as AAMI SW96 and AAMI TIR57.
Build security into development
Roll out the secure development framework (IEC 81001-5-1, IEC 62304), define security controls, produce and maintain the SBOM.
Test the device
Have an independent team carry out penetration and vulnerability testing of hardware, firmware, radio links, applications and cloud, with a report usable for the submission.
Assemble the file and prepare postmarket
Compile the documentation in the expected format (eSTAR), establish traceability, write the vulnerability management plan and the coordinated disclosure process.
FDA, MDR and Cyber Resilience Act: pooling the evidence
In Europe, Regulation (EU) 2017/745 (MDR) also sets cybersecurity requirements (Annex I, sections 17.2, 17.4 and 18.8), detailed in the MDCG 2019-16 guidance. Products in your range that are not medical devices — gateways, companion apps, wellness devices — fall under the Cyber Resilience Act.
All three frameworks rest on the same foundation: risk analysis, SBOM, coordinated vulnerability management, secure development and penetration testing. A well-built programme produces evidence that can be reused for the FDA and for CE marking.
Sources
- FDA — Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions (final guidance, February 2026)
- FDA — Postmarket Management of Cybersecurity in Medical Devices
- FDA — Cybersecurity in Medical Devices: Frequently Asked Questions
- FDA — Cybersecurity (Digital Health Center of Excellence)
Preparing your FDA cybersecurity file
Dipole Security, PASSI qualified and specialised in medtech, performs the gap analysis, threat modelling and independent penetration testing of your device, with a submission-ready report.