Why Cybersecurity Is Now a Regulatory Requirement
Since March 2023, the FDA has had explicit authority under Section 524B of the FD&C Act to require cybersecurity information in premarket submissions for cyber devices. As of late 2023, the agency began issuing Refuse to Accept (RTA) decisions for submissions that lack adequate cybersecurity documentation.
This is no longer optional. If your medical device connects to the internet, communicates wirelessly, or contains software, cybersecurity is a mandatory part of your regulatory strategy.
What Qualifies as a "Cyber Device"?
Under the statute, a cyber device is a device that:
- Includes software validated, installed, or authorized by the sponsor
- Has the ability to connect to the internet
- Contains technology that could be vulnerable to cybersecurity threats
This definition covers a broad range of products — from implantable cardiac devices and insulin pumps to diagnostic imaging systems, patient monitors, and even mobile health apps classified as medical devices.
Key FDA Cybersecurity Requirements
1. Security Risk Management
Manufacturers must integrate cybersecurity into their overall risk management process (typically aligned with ISO 14971). This includes:
- Threat modeling to identify potential attack vectors
- Security risk assessment documenting the likelihood and impact of identified threats
- Risk controls with traceability to specific threats
- Ongoing monitoring and update plans
2. Software Bill of Materials (SBOM)
Every premarket submission for a cyber device must include a Software Bill of Materials — a complete inventory of all software components, including:
- Commercial and open-source third-party components
- Version numbers for each component
- Known vulnerabilities (CVEs) associated with listed components
- Upstream support and patch availability status
The SBOM must follow a machine-readable format such as SPDX or CycloneDX.
3. Secure Product Development Framework (SPDF)
The FDA expects manufacturers to demonstrate that cybersecurity is embedded throughout the product lifecycle, not treated as an afterthought. The SPDF should cover:
- Security by design — architecture decisions that minimize attack surfaces
- Secure coding practices — static analysis, code review, dependency scanning
- Security testing — penetration testing, fuzz testing, vulnerability scanning
- Deployment and maintenance — patch management, coordinated vulnerability disclosure
4. Vulnerability Management and Patching
Your submission must include a plan for:
- Monitoring for new vulnerabilities post-market
- Timely patching and update deployment
- Coordinated vulnerability disclosure (CVD) — a public policy for receiving and responding to vulnerability reports from security researchers
- End-of-life planning when security updates will no longer be provided
Premarket Submission Documentation Checklist
When preparing your 510(k), De Novo, or PMA submission, ensure your cybersecurity package includes:
- System architecture diagrams with trust boundaries
- Threat model and security risk assessment
- SBOM in machine-readable format
- Description of the SPDF and evidence of implementation
- Security testing reports (penetration testing, static/dynamic analysis)
- Patch management and update plan
- Coordinated vulnerability disclosure policy
- Customer security documentation (hardening guides, network requirements)
Common Mistakes That Trigger RTA Decisions
- Missing SBOM — The single most common reason for cybersecurity-related RTA decisions
- Generic risk assessments — Using boilerplate language instead of device-specific threat analysis
- No patch plan — Failing to describe how software updates will be delivered
- Ignoring third-party components — Not accounting for vulnerabilities in open-source libraries
- Late integration — Attempting to add cybersecurity documentation after development is complete
Aligning with International Standards
While the FDA guidance is U.S.-focused, manufacturers selling globally should also consider:
- IEC 81001-5-1 — Security for the health software lifecycle (recognized by the EU MDR)
- IMDRF guidance on medical device cybersecurity
- Health Canada cybersecurity pre-market requirements
- AAMI TIR57 — Principles for medical device security risk management
Building your cybersecurity program around these harmonized standards reduces duplication and supports multi-market submissions.
How United Regulatory Can Help
Cybersecurity compliance is one of the fastest-growing areas of regulatory complexity for medical device manufacturers. Our team helps you:
- Develop a Secure Product Development Framework tailored to your device
- Prepare SBOM documentation in FDA-accepted formats
- Conduct cybersecurity gap assessments before submission
- Build complete premarket cybersecurity packages for 510(k), De Novo, and PMA filings
Don't risk an RTA decision. Contact us for a cybersecurity readiness assessment today.