Accelerate FDA Clearance. No Cyber Gaps Left Open.

“My device isn’t a cyber device.”

Section 524B(c) defines a cyber device by three conditions, all of which must be met: (1) it includes software validated, installed, or authorized by the sponsor, (2) it has the ability to connect to the internet, and (3) it contains technological characteristics that could be vulnerable to cybersecurity threats. BLE pairing, a USB charging port, or a companion app each satisfy condition 2. If your device meets all three, the full SPDF, SBOM, threat model, and pen test package is mandatory - and the FDA can refuse to accept the submission without it.

“My developers know cybersecurity.”

Reviewers don't ask if your team can write secure code. They ask for a STRIDE-based threat model traced to ISO 14971 hazards, a CycloneDX SBOM with VEX justifications for every flagged CVE, security architecture views (global system, multi-patient harm, updateability, security use cases), and independent pen test evidence documenting tester independence, scope, methods and results. We watched one team's submission get a Major Deficiency because their threat model listed mitigations without traceability to the design history file - reviewer wanted to see the chain, not the conclusion.

“It’s about protecting data.”

The FDA's February 2026 final premarket guidance (Section IV) frames cybersecurity as patient safety, device availability, and data integrity - in that order. HIPAA and data confidentiality language alone gets flagged as a scope gap. Your threat model has to show how a compromise could harm a patient, render the device unavailable, or corrupt the data it acts on. That is the lens reviewers apply.

“We’ll add cybersecurity later.”

The Secure Product Development Framework (Section 524B(b)(2)) requires unbroken traceability from architecture decisions through threat model, security requirements, test evidence, and unresolved-anomaly disposition. Reviewers can tell when the chain was assembled after design freeze: dates don't line up, threat model assumptions contradict the as-built design, and the design history file has no security entries before V&V. The result is a Major Deficiency on SPDF and a request to redo design controls - 6 to 9 months added to your timeline.

“Traditional IT cybersecurity works.”

IT pen testing assumes you can take a system offline. Medical device pen testing has to respect availability constraints - you cannot brick an infusion pump mid-test. The deliverable is a signed Letter of Attestation naming the testers, their independence, scope, and methodology, plus firmware-level testing the FDA increasingly expects (secure boot verification, OTA update path, debug interfaces). A SOC 2 report or a generic vulnerability scan rebadged for the device will be rejected.