--- title: "FDA Premarket Cybersecurity Submission Checklist - MedTech…" description: "Section-by-section checklist mirroring FDA's RTA cybersecurity items: security risk management, SBOM, threat model, testing evidence, labeling, and CVD policy." lang: en json-ld: | [ { "@context": "https://schema.org", "@graph": [ { "@type": "WebSite", "@id": "https://medtechcybertips.com/#website", "url": "https://medtechcybertips.com/", "name": "MedTech Cyber Tips", "description": "The ultimate organized guide to medical device cybersecurity.", "inLanguage": "en-US", "publisher": { "@id": "https://medtechcybertips.com/#org" }, "potentialAction": { "@type": "SearchAction", "target": "https://medtechcybertips.com/topics?q={search_term_string}", "query-input": "required name=search_term_string" } }, { "@type": "Organization", "@id": "https://medtechcybertips.com/#org", "name": "MedTech Cyber Tips", "url": "https://medtechcybertips.com/", "logo": "https://medtechcybertips.com/icon-512.png", "sponsor": { "@type": "Organization", "name": "Blue Goat Cyber", "url": "https://bluegoatcyber.com", "sameAs": [ "https://home.bluegoatcyber.com/", "https://codebluechart.com/", "https://why.bluegoatcyber.com/", "https://spdf.bluegoatcyber.com/", "https://threatmodel.bluegoatcyber.com/", "https://pentesting.bluegoatcyber.com/", "https://premarket.bluegoatcyber.com/", "https://fdaresponse.bluegoatcyber.com/", "https://postmarket.bluegoatcyber.com/", "https://goatwatch.bluegoatcyber.com/" ] } } ] }, { "@context": "https://schema.org", "@type": "HowTo", "name": "FDA Premarket Cybersecurity Submission Checklist", "description": "Section-by-section checklist mirroring FDA's RTA cybersecurity items: security risk management, SBOM, threat model, testing evidence, labeling, and CVD policy.", "url": "https://medtechcybertips.com/resources/premarket-cyber-submission-checklist", "step": [ { "@type": "HowToSection", "position": 1, "name": "1. Security Risk Management", "itemListElement": [ { "@type": "HowToStep", "position": 1, "name": "Security risk management plan referenced in the submission" }, { "@type": "HowToStep", "position": 2, "name": "Threats, vulnerabilities, and assets enumerated" }, { "@type": "HowToStep", "position": 3, "name": "Risk acceptance criteria defined and approved" }, { "@type": "HowToStep", "position": 4, "name": "Residual risk evaluated post-controls" }, { "@type": "HowToStep", "position": 5, "name": "Traceability from threat → control → verification evidence" } ] }, { "@type": "HowToSection", "position": 2, "name": "2. Threat Model", "itemListElement": [ { "@type": "HowToStep", "position": 1, "name": "System-level data-flow diagram included" }, { "@type": "HowToStep", "position": 2, "name": "Trust boundaries and entry points identified" }, { "@type": "HowToStep", "position": 3, "name": "STRIDE (or equivalent) categorization complete" }, { "@type": "HowToStep", "position": 4, "name": "Threats mapped to mitigations and tests" }, { "@type": "HowToStep", "position": 5, "name": "Third-party / cloud / mobile interfaces covered" } ] }, { "@type": "HowToSection", "position": 3, "name": "3. SBOM & Third-Party Software", "itemListElement": [ { "@type": "HowToStep", "position": 1, "name": "SBOM in CycloneDX or SPDX format" }, { "@type": "HowToStep", "position": 2, "name": "Includes component name, version, supplier, hash" }, { "@type": "HowToStep", "position": 3, "name": "End-of-support / end-of-life status documented" }, { "@type": "HowToStep", "position": 4, "name": "Known vulnerabilities triaged with VEX" }, { "@type": "HowToStep", "position": 5, "name": "Plan to update SBOM through device lifecycle" } ] }, { "@type": "HowToSection", "position": 4, "name": "4. Security Testing Evidence", "itemListElement": [ { "@type": "HowToStep", "position": 1, "name": "Vulnerability scan reports (network + host)" }, { "@type": "HowToStep", "position": 2, "name": "Static and dynamic application security testing" }, { "@type": "HowToStep", "position": 3, "name": "Software composition analysis results" }, { "@type": "HowToStep", "position": 4, "name": "Penetration test report by a qualified party" }, { "@type": "HowToStep", "position": 5, "name": "Fuzz testing on protocol / file parsers where applicable" } ] }, { "@type": "HowToSection", "position": 5, "name": "5. Labeling & Customer Documentation", "itemListElement": [ { "@type": "HowToStep", "position": 1, "name": "MDS2 (or equivalent) provided" }, { "@type": "HowToStep", "position": 2, "name": "Network ports, protocols, and services documented" }, { "@type": "HowToStep", "position": 3, "name": "Authentication and account management described" }, { "@type": "HowToStep", "position": 4, "name": "Backup, restore, and patch procedures included" }, { "@type": "HowToStep", "position": 5, "name": "End-of-support date communicated" } ] }, { "@type": "HowToSection", "position": 6, "name": "6. Coordinated Vulnerability Disclosure", "itemListElement": [ { "@type": "HowToStep", "position": 1, "name": "Public CVD policy with intake channel" }, { "@type": "HowToStep", "position": 2, "name": "SLA for acknowledgment, triage, and fix" }, { "@type": "HowToStep", "position": 3, "name": "Process to issue advisories and CVEs" }, { "@type": "HowToStep", "position": 4, "name": "Postmarket monitoring plan referenced" }, { "@type": "HowToStep", "position": 5, "name": "Internal PSIRT roles and escalation defined" } ] } ] }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://medtechcybertips.com" }, { "@type": "ListItem", "position": 2, "name": "Resources", "item": "https://medtechcybertips.com/resources" }, { "@type": "ListItem", "position": 3, "name": "FDA Premarket Cybersecurity Submission Checklist", "item": "https://medtechcybertips.com/resources/premarket-cyber-submission-checklist" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What is in an FDA premarket cybersecurity submission?", "acceptedAnswer": { "@type": "Answer", "text": "A complete package includes a security risk assessment, threat model, SBOM, security testing evidence (including penetration testing), security architecture views, labeling, a coordinated vulnerability disclosure (CVD) policy, and a postmarket monitoring and patching plan. The FDA's February 3 2026 premarket cybersecurity guidance enumerates each element." } }, { "@type": "Question", "name": "When does the FDA require this checklist's items?", "acceptedAnswer": { "@type": "Answer", "text": "For any 'cyber device' submitted under a 510(k), De Novo, or PMA after the Section 524B effective date (March 29, 2023). FDA can issue a Refuse to Accept (RTA) decision if required cybersecurity items are missing, so this checklist is intended for use during your final pre-submission design review." } }, { "@type": "Question", "name": "Do I need a penetration test before submission?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. The FDA expects a penetration test by a qualified party as part of the security testing evidence. The report should document scope, methodology, findings, severity, and remediation, and the testers should be independent of the device's development team." } }, { "@type": "Question", "name": "What format should the SBOM be in for FDA submission?", "acceptedAnswer": { "@type": "Answer", "text": "Machine-readable CycloneDX (1.4 or later) or SPDX (2.3 or later) is expected. Each component should include name, version, supplier, a unique identifier (PURL or CPE), and a cryptographic hash, and the SBOM should be paired with a VEX document that triages known vulnerabilities." } }, { "@type": "Question", "name": "Is there a specific labeling section required for cybersecurity?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. The 2026 guidance expects device labeling to describe cybersecurity controls, supported software update mechanisms, the length of support, and instructions for coordinated vulnerability disclosure. Missing labeling is a common RTA trigger." } } ] } ] --- [Skip to main content](#main) [ MedTech Cyber Tips The Ultimate Guide ](/) [Home](/)[Find Your Path](/journey)[All Topics](/topics)Reference[About](/about) Search ⌘K [All resources](/resources) Premarket · 6 min · 30 items # FDA Premarket Cybersecurity Submission Checklist A pre-flight check before you submit. Use it during your final design review to make sure every item the FDA expects in a premarket cybersecurity package is present, traceable, and defensible. Progress 0 / 30 (0%) Reset Print ## 1\. Security Risk Management Aligned with AAMI [TIR57](/glossary/tir57) / [ISO 14971](/glossary/iso-14971) - separate from safety risk but linked. - Security risk management plan referenced in the submission - Threats, vulnerabilities, and assets enumerated - Risk acceptance criteria defined and approved - Residual risk evaluated post-controls - Traceability from threat → control → verification evidence ## 2\. Threat Model Per FDA 2026 cybersecurity guidance, include a threat model for the system and key components. - System-level data-flow diagram included - Trust boundaries and entry points identified - STRIDE (or equivalent) categorization complete - Threats mapped to mitigations and tests - Third-party / cloud / mobile interfaces covered ## 3\. SBOM & Third-Party Software Machine-readable [SBOM](/glossary/sbom) with support status per component. - SBOM in CycloneDX or SPDX format - Includes component name, version, supplier, hash - End-of-support / end-of-life status documented - Known vulnerabilities triaged with VEX - Plan to update SBOM through device lifecycle ## 4\. Security Testing Evidence Show breadth (scan) and depth (manual). - Vulnerability scan reports (network + host) - Static and dynamic application security testing - Software composition analysis results - Penetration test report by a qualified party - Fuzz testing on protocol / file parsers where applicable ## 5\. Labeling & Customer Documentation What hospitals need to deploy and operate the device securely. - MDS2 (or equivalent) provided - Network ports, protocols, and services documented - Authentication and account management described - Backup, restore, and patch procedures included - End-of-support date communicated ## 6\. Coordinated Vulnerability Disclosure Required by section [524B](/glossary/524b) of the [FD&C Act](/glossary/fd-and-c-act). - Public CVD policy with intake channel - SLA for acknowledgment, triage, and fix - Process to issue advisories and CVEs - Postmarket monitoring plan referenced - Internal PSIRT roles and escalation defined ## Frequently asked questions Quick answers to the questions teams most often ask about this topic. ### What is in an FDA premarket cybersecurity submission? A complete package includes a security risk assessment, threat model, SBOM, security testing evidence (including penetration testing), security architecture views, labeling, a coordinated vulnerability disclosure (CVD) policy, and a postmarket monitoring and patching plan. The FDA's February 3 2026 premarket cybersecurity guidance enumerates each element. ### When does the FDA require this checklist's items? For any 'cyber device' submitted under a 510(k), De Novo, or PMA after the Section 524B effective date (March 29, 2023). FDA can issue a Refuse to Accept (RTA) decision if required cybersecurity items are missing, so this checklist is intended for use during your final pre-submission design review. ### Do I need a penetration test before submission? Yes. The FDA expects a penetration test by a qualified party as part of the security testing evidence. The report should document scope, methodology, findings, severity, and remediation, and the testers should be independent of the device's development team. ### What format should the SBOM be in for FDA submission? Machine-readable CycloneDX (1.4 or later) or SPDX (2.3 or later) is expected. Each component should include name, version, supplier, a unique identifier (PURL or CPE), and a cryptographic hash, and the SBOM should be paired with a VEX document that triages known vulnerabilities. ### Is there a specific labeling section required for cybersecurity? Yes. The 2026 guidance expects device labeling to describe cybersecurity controls, supported software update mechanisms, the length of support, and instructions for coordinated vulnerability disclosure. Missing labeling is a common RTA trigger. Sponsored | how Blue Goat Cyber℠ helps ### Submit a package the FDA will accept Blue Goat Cyber℠ builds the cybersecurity sections of 510(k), De Novo, and PMA submissions, SBOM, threat model, testing, and the cybersecurity management plan. [Get help with your premarket submission](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session) 4.9 / 5 · 15+ client reviews "Great results, would recommend." Michael Phillips 250+ FDA submissions · 0 rejections Veteran-owned, Scottsdale AZ Exclusively medical device cybersecurity [ Next SBOM Quality & VEX Readiness Checklist ](/resources/sbom-quality-checklist) MedTech Cyber Tips The organized, end-to-end guide to medical device cybersecurity, from concept through postmarket. Part of the Blue Goat Cyber family. Topics - [Overview](/topics/home) - [Why It Matters](/topics/why) - [SPDF](/topics/spdf) - [Threat Modeling](/topics/threatmodel) - [Pentesting](/topics/pentesting) Reference - [Glossary](/glossary) - [FDA vs MDR](/compare) - [Resources](/resources) - [Updates](/updates) - [RSS feed](/rss.xml) © 2026 medtechcybertips.com. An educational resource sponsored by Blue Goat Cyber. Not legal or regulatory advice.