--- title: "Two years of Section 524B: what FDA reviewers are pushing…" description: "Patterns from recent deficiency letters: weak SBOM hygiene, missing VEX statements, and CVD policies that exist on paper but have no real intake." lang: en json-ld: | [ { "@context": "https://schema.org", "@graph": [ { "@type": "WebSite", "@id": "https://medtechcybertips.com/#website", "url": "https://medtechcybertips.com/", "name": "MedTech Cyber Tips", "description": "The ultimate organized guide to medical device cybersecurity.", "inLanguage": "en-US", "publisher": { "@id": "https://medtechcybertips.com/#org" }, "potentialAction": { "@type": "SearchAction", "target": "https://medtechcybertips.com/topics?q={search_term_string}", "query-input": "required name=search_term_string" } }, { "@type": "Organization", "@id": "https://medtechcybertips.com/#org", "name": "MedTech Cyber Tips", "url": "https://medtechcybertips.com/", "logo": "https://medtechcybertips.com/icon-512.png", "sponsor": { "@type": "Organization", "name": "Blue Goat Cyber", "url": "https://bluegoatcyber.com", "sameAs": [ "https://home.bluegoatcyber.com/", "https://codebluechart.com/", "https://why.bluegoatcyber.com/", "https://spdf.bluegoatcyber.com/", "https://threatmodel.bluegoatcyber.com/", "https://pentesting.bluegoatcyber.com/", "https://premarket.bluegoatcyber.com/", "https://fdaresponse.bluegoatcyber.com/", "https://postmarket.bluegoatcyber.com/", "https://goatwatch.bluegoatcyber.com/" ] } } ] }, { "@context": "https://schema.org", "@type": "BlogPosting", "headline": "Two years of Section 524B: what FDA reviewers are pushing back on", "description": "Patterns from recent deficiency letters: weak SBOM hygiene, missing VEX statements, and CVD policies that exist on paper but have no real intake.", "datePublished": "2025-10-15", "dateModified": "2025-10-15", "url": "https://medtechcybertips.com/updates/524b-two-year-checkin", "mainEntityOfPage": "https://medtechcybertips.com/updates/524b-two-year-checkin", "author": { "@type": "Person", "@id": "https://medtechcybertips.com/authors/editorial-team", "name": "MedTech Cyber Tips Editorial Team" }, "reviewedBy": { "@type": "Person", "@id": "https://medtechcybertips.com/authors/editorial-team", "name": "MedTech Cyber Tips Editorial Team" }, "publisher": { "@type": "Organization", "name": "MedTech Cyber Tips", "url": "https://medtechcybertips.com", "sponsor": { "@type": "Organization", "name": "Blue Goat Cyber" } }, "articleSection": "FDA" }, { "@context": "https://schema.org", "@type": "Person", "@id": "https://medtechcybertips.com/authors/editorial-team", "url": "https://medtechcybertips.com/authors/editorial-team", "name": "MedTech Cyber Tips Editorial Team", "jobTitle": "Medical Device Cybersecurity Editors", "description": "The MedTech Cyber Tips editorial team is a group of practitioners with hands-on experience across FDA premarket cybersecurity submissions, Secure Product Development Framework (SPDF) implementation, medical device threat modeling, and postmarket vulnerability management. Every article, checklist, and update on this site is reviewed for accuracy against the FDA's February 3, 2026 final premarket cybersecurity guidance, Section 524B of the FD&C Act, MDCG 2019-16 Rev.2, IEC 81001-5-1, ISO 14971, and the EU Cyber Resilience Act. The team also tracks 510(k) deficiency patterns and CVE trends affecting connected medical devices so guidance on the site stays current.", "knowsAbout": [ "Medical device cybersecurity", "FDA Section 524B", "FDA premarket cybersecurity guidance (Feb 3, 2026)", "Secure Product Development Framework", "SBOM and VEX", "Medical device threat modeling", "Postmarket vulnerability management", "EU MDR cybersecurity (MDCG 2019-16 Rev.2)", "EU Cyber Resilience Act", "IEC 81001-5-1", "ISO 14971 risk management" ], "sameAs": [ "https://bluegoatcyber.com/about" ], "worksFor": { "@type": "Organization", "name": "MedTech Cyber Tips", "url": "https://medtechcybertips.com/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://medtechcybertips.com" }, { "@type": "ListItem", "position": 2, "name": "Updates", "item": "https://medtechcybertips.com/updates" }, { "@type": "ListItem", "position": 3, "name": "Two years of Section 524B: what FDA reviewers are pushing back on", "item": "https://medtechcybertips.com/updates/524b-two-year-checkin" } ] } ] --- [Skip to main content](#main) [ MedTech Cyber Tips The Ultimate Guide ](/) [Home](/)[Find Your Path](/journey)[All Topics](/topics)Reference[About](/about) Search ⌘K [Updates](/updates) FDA October 15, 2025 # Two years of Section 524B: what FDA reviewers are pushing back on Patterns from recent deficiency letters: weak SBOM hygiene, missing VEX statements, and CVD policies that exist on paper but have no real intake. Reviewed by [MedTech Cyber Tips Editorial Team](/authors/editorial-team) · Published Oct 15, 2025 · Last reviewed July 2026 Two years into Section [524B](/glossary/524b) enforcement, the most common FDA cybersecurity deficiencies cluster around three themes: 1\. SBOMs that list components but lack version pinning, hash, or supplier - making vulnerability monitoring impossible to verify. 2\. No [VEX](/glossary/vex) (Vulnerability Exploitability eXchange) statements paired with the [SBOM](/glossary/sbom), leaving reviewers to assume every [CVE](/glossary/cve) is exploitable. 3\. Coordinated Vulnerability Disclosure policies with no working intake address, no triage SLA, and no evidence of past coordination. Fix these three before submission and you'll preempt the majority of cyber RTAs. More updates - [ MDCG 2019-16 Rev.2 at six months: Notified Body audit patterns Six months in, Notified Body audits under MDCG 2019-16 Rev.2 show three clear failure modes - narrative-only SBOMs, CVD policies without operational evidence, and traceability gaps between security risk controls and design outputs. Oct 2026](/updates/mdcg-2019-16-rev2-six-month-retrospective) - [ Three years of Section 524B: the deficiencies that never went away Three-year retrospective on Section 524B enforcement: SBOM depth, VEX justification, and CVD operational evidence remain the top three categories of cyber deficiencies. Two new patterns emerged in 2026 - AI/ML threat-model gaps and weak end-of-support labeling. Oct 2026](/updates/524b-three-year-checkin) - [ IEC 81001-5-1 Amendment 1 reaches FDIS - what MedTech teams should track Amendment 1 to IEC 81001-5-1 (health software security lifecycle) is in Final Draft International Standard ballot. It sharpens SBOM, CVD, and postmarket vulnerability expectations - and it's the standard EU Notified Bodies are quietly aligning MDCG 2019-16 audits against. Sep 2026](/updates/iec-81001-5-1-amendment-1-fdis) MedTech Cyber Tips The organized, end-to-end guide to medical device cybersecurity, from concept through postmarket. Part of the Blue Goat Cyber family. Topics - [Overview](/topics/home) - [Why It Matters](/topics/why) - [SPDF](/topics/spdf) - [Threat Modeling](/topics/threatmodel) - [Pentesting](/topics/pentesting) Reference - [Glossary](/glossary) - [FDA vs MDR](/compare) - [Resources](/resources) - [Updates](/updates) - [RSS feed](/rss.xml) © 2026 medtechcybertips.com. An educational resource sponsored by Blue Goat Cyber. Not legal or regulatory advice.