FDA Premarket Cybersecurity Submission Checklist
A pre-flight check before you submit. Use it during your final design review to make sure every item the FDA expects in a premarket cybersecurity package is present, traceable, and defensible.
1. Security Risk Management
Aligned with AAMI TIR57 / ISO 14971 — separate from safety risk but linked.
2. Threat Model
Per FDA 2026 cybersecurity guidance, include a threat model for the system and key components.
3. SBOM & Third-Party Software
Machine-readable SBOM with support status per component.
4. Security Testing Evidence
Show breadth (scan) and depth (manual).
5. Labeling & Customer Documentation
What hospitals need to deploy and operate the device securely.
6. Coordinated Vulnerability Disclosure
Required by section 524B of the FD&C Act.
Frequently asked questions
Quick answers to the questions teams most often ask about this topic.
A complete package includes a security risk assessment, threat model, SBOM, security testing evidence (including penetration testing), security architecture views, labeling, a coordinated vulnerability disclosure (CVD) policy, and a postmarket monitoring and patching plan. The FDA's 2026 cybersecurity guidance on medical devices enumerates each element.
For any 'cyber device' submitted under a 510(k), De Novo, or PMA after the Section 524B effective date (March 29, 2023). FDA can issue a Refuse to Accept (RTA) decision if required cybersecurity items are missing, so this checklist is intended for use during your final pre-submission design review.
Yes. The FDA expects a penetration test by a qualified party as part of the security testing evidence. The report should document scope, methodology, findings, severity, and remediation, and the testers should be independent of the device's development team.
Machine-readable CycloneDX (1.4 or later) or SPDX (2.3 or later) is expected. Each component should include name, version, supplier, a unique identifier (PURL or CPE), and a cryptographic hash, and the SBOM should be paired with a VEX document that triages known vulnerabilities.