510(k) Cybersecurity Timeline: Six Phases and Deliverables

Six phases and their deliverables

Phases can overlap. Dates depend on your device, your evidence, and your filing plan. They are agreed during scoping.

Premarket to submission

Your 510(k) cybersecurity timeline

A sequence of work, not a fixed calendar. Dates depend on scope, evidence, device access, engineering fixes, retests, and manufacturer review. Each engagement includes only the deliverables agreed in its proposal.

Step 1 of 6: Premarket planning

Define the device and scope

Start with the clinical use and the patient harm a security failure could cause. Agree the device configuration, evidence gaps, and work to be performed.

Deliverables

Cybersecurity scope and device/interface inventory
Section 524B applicability rationale
Evidence gap list, document owners, and agreed delivery milestones

Your team's inputs

Your team supplies intended use, architecture, software versions, existing records, available device access, and the target filing date.

Review and handoff

The manufacturer confirms the system boundary and included versions. Statutory duties and guidance recommendations are assessed separately.

All phase deliverables

1. Define the device and scope
- Cybersecurity scope and device/interface inventory
- Section 524B applicability rationale
- Evidence gap list, document owners, and agreed delivery milestones
2. Model threats and security controls
- Threat model and cybersecurity risk assessment
- Global system, multi-patient harm, updateability/patchability, and security use case architecture views
- Security requirements, control coverage, and initial traceability matrix
3. Build the software evidence
- Machine-readable SBOM for the identified configuration
- Component vulnerability assessment and support/end-of-support records
- SAST and software composition analysis results with human-reviewed dispositions, where scoped
4. Test, remediate, and retest
- Security Test Plan and Test Cases linked to threats and controls
- Penetration Test Report with configuration, scope, methods, actual duration, findings, limitations, and tester independence/expertise
- Remediation tracking, retest records, and updated risk and unresolved-anomaly assessments
5. Prepare lifecycle documents
- Cybersecurity labeling and user security instructions
- Postmarket cybersecurity management plan covering monitoring, vulnerability intake, coordinated disclosure, updates, and communications
- Cybersecurity metrics and limitations, with planned monitoring separate from observed results
6. Review and assemble for eSTAR
- Security risk management report and final traceability matrix
- eSTAR cybersecurity attachment index with document titles, revisions, and section/page references
- Recorded evidence gaps, applicability rationales, and manufacturer review decisions

Already have part of the evidence?

Standalone penetration testing covers the agreed test evidence. The FDA Premarket Cybersecurity Package adds the agreed documentation work. Existing records are reviewed before deciding what to produce.

FDA Premarket Cybersecurity Package

Check the evidence, document by document

eSTAR 7.1 Cybersecurity Documentation and Evidence Map

Based on the February 3, 2026 FDA premarket cybersecurity guidance and the FDA eSTAR Program. Guidance recommendations are distinct from Section 524B statutory duties.

The 510(k) cybersecurity timeline, phase by phase.

Six phases and their deliverables

Your 510(k) cybersecurity timeline

Define the device and scope

Deliverables

Your team's inputs

Review and handoff

1. Define the device and scope

2. Model threats and security controls

3. Build the software evidence

4. Test, remediate, and retest

5. Prepare lifecycle documents

6. Review and assemble for eSTAR

Already have part of the evidence?

Check the evidence, document by document

Related resources

Secure your device before it reaches patients.