FDA Premarket Cybersecurity Requirements for Medical Devices (FD&C Act §524B)

Record ID: biomedical-reg-007 (Biomedical · regulation · license) Issuing body / enforcer: U.S. Food and Drug Administration (FDA), CDRH Jurisdiction: United States

1. What it is

Section 524B of the Federal Food, Drug, and Cosmetic Act — added by the Consolidated Appropriations Act of 2023 — makes cybersecurity a premarket statutory requirement for "cyber devices." FDA will refuse to accept premarket submissions (510(k), PMA, De Novo) that do not include the required cybersecurity information. Since 1 October 2023, FDA has operated a "refuse to accept" policy for submissions missing cybersecurity elements — cybersecurity moved overnight from guidance-level expectation to submission gate.

This is distinct from HIPAA (which governs ePHI handling by covered entities): 524B governs the security of the device itself — its code, its interfaces, its updateability — as a condition of market authorization.

2. Scope and who it applies to

Applies to "cyber devices": devices containing software (including firmware), programmable logic, or that have the ability to connect to the internet — which in practice captures nearly every connected, software-driven, or software-containing device.
Triggers: Any 510(k), PMA, De Novo, or related premarket submission for a cyber device. The requirement attaches at submission, not at some later inspection.
Applies to the device manufacturer/sponsor; the obligations flow down to software suppliers through the SBOM and vulnerability-management expectations.

3. Key requirements and compliance obligations

The statute requires sponsors to submit:

A software bill of materials (SBOM): A machine-readable inventory of commercial, open-source, and off-the-shelf software components in the device, including version information. Engineers must be able to generate and maintain the SBOM across the product lifecycle — this is a build-system and supply-chain discipline, not a paperwork exercise.
Plans to monitor, identify, and address postmarket cybersecurity vulnerabilities: A vulnerability management plan covering monitoring (threat intelligence, coordinated disclosure intake), assessment, and remediation — within a reasonable time.
Plans and procedures for coordinated vulnerability disclosure: A public-facing process for receiving vulnerability reports from researchers.
Evidence of a secure product development framework (SPDF): Documented secure-development practices — threat modeling, security architecture, security testing (static/dynamic analysis, penetration testing commensurate with risk), and security-focused design controls.
Labeling: Cybersecurity-relevant labeling — including information for users on secure configuration, and disclosure of the device's cybersecurity controls.

FDA's premarket cybersecurity guidance (final guidance issued 2023, updated since) layers on expectations: threat modeling documentation, security risk assessment integrated with the ISO 14971 risk file, architecture views showing trust boundaries and data flows, and penetration testing evidence for higher-risk devices. The eSTAR template now embeds cybersecurity sections — an incomplete cybersecurity section fails acceptance review.

Postmarket linkage: The premarket vulnerability-management plan connects to FDA's postmarket cybersecurity guidance — patching cadence, coordinated disclosure handling, and communication of vulnerabilities to users are ongoing obligations, not submission-time artifacts.

4. Penalties and consequences of non-compliance

Refuse-to-accept: The immediate consequence — FDA will not review a submission lacking required cybersecurity information. This is a schedule-killer, not a fine.
Once marketed, cybersecurity failures are enforced through the standard device authorities: adulteration (QMSR/design-control deficiencies in the security process), recalls and safety communications (FDA has issued cybersecurity safety communications for devices with unpatched vulnerabilities), and in egregious cases seizure/injunction.
Liability exposure: A documented-then-ignored vulnerability with patient harm is the fact pattern product-liability plaintiffs' firms look for — the SBOM and vulnerability-management records are discoverable.

5. Version and live changes — status

Statutory basis: FD&C Act §524B, via the Consolidated Appropriations Act, 2023 (enacted December 2022).
Refuse-to-accept enforcement since 1 October 2023.
FDA premarket cybersecurity guidance continues to evolve (quality-system-adjacent expectations increasingly reference IEC 81001-5-1 for secure lifecycle processes).
⚠️ Flag (catalogue: estimated): The catalogue record for 524B is marked "estimated" — details drawn from industry/guidance knowledge. Confirm the exact statutory citation, current guidance edition, and eSTAR template requirements at fda.gov before citing in regulatory writing. Do not treat this brief's guidance-edition references as current without checking.

From the catalogue (record_type=certification, importance=license/flagship, Biomedical):

RAC-Devices (RAPS) — cybersecurity submission requirements are now tested regulatory-strategy content.
CCE — clinical engineers encounter device cybersecurity in hospital network-risk management.
PE — not tested.
Gap note: No catalogue certification is a dedicated medical-device cybersecurity credential; practitioners typically pair RAC with general security credentials (outside this catalogue's scope).

7. Honest flags

This brief's statutory and enforcement facts (524B, 2023 omnibus, Oct 2023 RTA policy, SBOM/vulnerability-plan requirements) reflect widely reported FDA posture, but the catalogue itself flags this record as estimated — re-verify at fda.gov before formal use.
Interaction with EU MDR cybersecurity expectations (MDR GSPRs + MDCG 2019-16 guidance) is a separate track; a device sold in both markets needs both.

Original ETS reference writing, verified against public sources on 2026-09-30. Thin sourcing is flagged inline. Not legal advice — confirm current editions with the issuing body.

FDA Premarket Cybersecurity Requirements for Medical Devices (FD&C Act §524B)