Get your medical device through FDA cybersecurity review, without the scramble.

“My device isn’t a cyber device.”

Section 524B(c) defines a cyber device by three conditions, all of which must be met: (1) it includes software validated, installed, or authorized by the sponsor, (2) it has the ability to connect to the internet, and (3) it contains technological characteristics that could be vulnerable to cybersecurity threats. BLE pairing, a USB charging port, or a companion app each satisfy condition 2. If your device meets all three, the full SPDF, SBOM, threat model, and pen test package is mandatory - and the FDA can refuse to accept the submission without it.

“My developers know cybersecurity.”

Reviewers don't ask if your team can write secure code. They ask for a STRIDE-based threat model traced to ISO 14971 hazards, a machine-readable SBOM with vulnerability assessments and optional VEX statements, security architecture views (global system, multi-patient harm, updateability, security use cases), and independent pen test evidence documenting tester independence, scope, methods and results. We watched one team's submission get a Major Deficiency because their threat model listed mitigations without traceability to the design history file - reviewer wanted to see the chain, not the conclusion.

“It’s about protecting data.”

The FDA's February 2026 final premarket guidance (Section IV) frames cybersecurity as patient safety, device availability, and data integrity - in that order. HIPAA and data confidentiality language alone gets flagged as a scope gap. Your threat model has to show how a compromise could harm a patient, render the device unavailable, or corrupt the data it acts on. That is the lens reviewers apply.

“We’ll add cybersecurity later.”

The FDA recommends an SPDF with traceability from architecture and threats through security requirements, test evidence, and unresolved-anomaly disposition. Late documentation gaps can require rework; the impact depends on the device and the gaps identified.

“Traditional IT cybersecurity works.”

IT pen testing assumes you can take a system offline. Medical device pen testing has to respect availability constraints - you cannot brick an infusion pump mid-test. The deliverable is a signed Letter of Attestation naming the testers, their independence, scope, and methodology, plus firmware-level testing the FDA increasingly expects (secure boot verification, OTA update path, debug interfaces). A SOC 2 report or a generic vulnerability scan rebadged for the device will be rejected.