8 FDA Cybersecurity Documentation Gaps to Review

The FDA’s February 3, 2026 guidance describes recommended cybersecurity evidence. Use the eight categories below to review your documents against that guidance and any device-specific request. General guidance does not establish how often individual findings occur.

Blue Goat Cyber has reviewed approximately 50 FDA deficiency letters. The categories below are a practical evidence checklist, not a statistical ranking of those letters.

Why this matters

Under Section 524B of the FD&C Act, the FDA can refuse to accept a cyber device submission that lacks required cybersecurity content, and reviewers apply the February 3, 2026 final premarket cybersecurity guidance to everything that gets through. An Additional Information letter pauses the review clock and gives you 180 days to respond. Every one of the findings below can be caught before submission, which is far cheaper than answering it under a deadline.

Official sources: FDA, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026); FDA eSTAR Program; FDA Cybersecurity in Medical Devices FAQs (Section 524B).

The review categories

These categories follow recommended documentation topics in the FDA guidance, Sections V and VI. Their order is not a frequency ranking.

1. SBOM

Review question: the SBOM does not carry the data the FDA asked for. An SBOM is rarely missing outright.

Potential gap: missing component, support, or vulnerability information. FDA guidance recommends support information and explaining unavailable information; its February 2026 recommendations reference the NTIA baseline, not a later CISA publication.

Supporting evidence to assess: a machine-readable SBOM (SPDX or CycloneDX) with support status per component, dated end-of-support, current CISA SBOM minimum elements, and a per-component vulnerability assessment against NVD and CISA KEV.

The third row is the point. A good SBOM names the gap. A blank cell, or an SBOM that omits the module entirely, is what draws the finding. See our SBOM guidance for FDA submissions for more.

2. Security controls written as principles

Review question: only a high-level description was provided, so the adequacy of the control cannot be determined.

Potential gap: controls expressed as goals rather than specifications. Identify implemented password policy, cryptographic protocols, algorithms, parameters, and configurations. No individual letter count is asserted here.

Supporting evidence to assess: every control gets a unique requirement ID written at specification level, traced to the test case that verified it. "The device authenticates users" cannot be tested. SEC-AUTH-014, verified by TC-SEC-014-03 with pass/fail evidence, can. Our guide to security requirements testing covers the traceability chain.

3. Cybersecurity labeling

Review question: the labeling plan is not labeling. Does the content actually reach the customer?

Potential gap: incomplete customer-facing information about interfaces, secure configuration, updates, anomalous behavior, backup and restore, forensic support, or decommissioning. Assess relevant labeling recommendations in Section VI.A against the actual device.

Supporting evidence to assess: a labeling checklist mapped one to one against the FDA's expected elements and verified against the customer-facing document itself, not the submission narrative describing it.

4. Security and penetration testing

Review question: vulnerability scanning is not a substitute for penetration testing. A scan identifies known vulnerabilities; a penetration test demonstrates impact.

Potential gap: unexplained scope exclusions or inadequate evidence of tester independence. Review bridging components and local agents where they are in the device system boundary.

Supporting evidence to assess: a full-system penetration test report covering tester independence and expertise, scope, duration, methods, and results. See our FDA penetration testing service.

5. Cybersecurity risk assessment

Review question: no stated methodology or acceptance criteria, and impact written as a system effect rather than patient harm.

Potential gap: an undefined assessment method, mismatched risk identifiers, or missing links from threats to requirements and evidence. Technical severity does not itself establish patient harm.

See also: FDA IDE Cybersecurity Requirements: 2026, SBOM Diffing and CVE Correlation: A Practical Workflow Supporting Section 524B Duties, and FDA Cybersecurity Major vs Minor.

Supporting evidence to assess: a documented methodology (CVSS with AAMI TIR57 or ANSI/AAMI SW96), matched risk IDs, pre- and post-mitigation levels, and a cross-reference against NVD and CISA KEV. In our method, exploitability is scored once and feeds two matrices: security impact on the SW96 side and severity of patient harm on the ISO 14971 side. Only threats that could affect patient safety carry into the ISO 14971 risk management file.

6. Cybersecurity risk management report

Review question: the report points at other documents instead of standing on its own.

Potential gap: describing supporting documents without stating assessment results and residual-risk conclusions. Keep security and safety analyses connected while preserving their distinct meanings.

Supporting evidence to assess: one report that states the risk evaluation methods, the residual risk conclusion, and the mitigations actually performed, traced across the threat model, risk assessment, SBOM, and testing.

7. Unresolved anomalies

Review question: answering that there are no unresolved cybersecurity issues is not responsive. The FDA means known software defects deliberately left in the product.

Root cause: teams misread the question, or list functional bugs with no security-impact assessment, assessed in isolation from the risk management file.

Supporting evidence to assess: an anomaly-by-anomaly write-up: description, how it was found, root cause, impact on safety and effectiveness, and a risk-based rationale for not fixing it.

8. Threat model

Review question: the assumption that the network is hostile is not stated.

Potential gap: omitted supply-chain, deployment, maintenance, or decommissioning threats. For AI-enabled functions, assess poisoning, inversion, and evasion where relevant; do not infer prevalence or feasibility from a missing heading.

Supporting evidence to assess: a threat model that states the hostile-network assumption, covers the full lifecycle, names AI-specific threats where relevant, and carries pre- and post-mitigation scores into the risk assessment. See our threat modeling service.

Five checks before you submit

1. Review the SBOM. Verify build coverage, available support information, and known-vulnerability assessment. Explain information that cannot be provided. A later CISA update does not automatically amend FDA guidance.
2. Review actual labeling. Check device-relevant Section VI.A recommendations in the customer-facing documents.
3. Trace controls to evidence. Link implemented requirements to relevant test results.
4. Justify testing scope. Document tester independence and expertise, scope, duration, methods, results, and exclusions.
5. Separate risk concepts. Do not substitute generic exploitation probability or CVSS for device-specific security and patient-safety assessment.

Or run our free FDA readiness check first.

How Blue Goat approaches this

We build each of these artifacts as one traceable set: threat model to risk assessment to requirement IDs to test cases to labeling. Blue Goat track record: 275+ FDA submissions supported, zero cybersecurity rejections. If the FDA sends a cybersecurity deficiency on work we delivered, we help resolve it at no extra cost. If you already have a letter, our deficiency letter triage tool sorts each finding by type and urgency. Nothing here guarantees an FDA outcome; the FDA makes its own determinations.

If you want one team to own the whole cybersecurity package, see our full-service FDA premarket cybersecurity submission support.

Related reading: FDA Cybersecurity Deficiency Response Timeline (2026), FDA Cybersecurity Failure Consequences for Medical Devices in 2026.

FAQ

Is this a frequency ranking from FDA letters?

No. This article presents documentation review categories, not a verified ten-letter tally or FDA-wide frequency dataset. Blue Goat Cyber’s approximately 50 reviewed letters is a separate company-experience claim.

Which cybersecurity documentation gap should we prioritize?

Prioritize the gaps in your actual device evidence and any FDA request. There is no substantiated frequency ranking here. SBOM, testing, architecture, risk, labeling, and process evidence must be assessed together.

Is a vulnerability scan enough for the FDA?

No. FDA guidance Section V.C distinguishes vulnerability scanning from penetration testing and recommends relevant evidence for both. A scan finds known vulnerabilities; a penetration test shows whether they can be exploited and what the impact is, across the full system scope.

What does the FDA mean by unresolved anomalies?

Known software defects deliberately left in the released product. Answering that there are no unresolved cybersecurity issues is not responsive. Each anomaly needs a description, how it was found, root cause, safety and effectiveness impact, and a risk-based rationale for leaving it.

How long do I have to respond to an FDA deficiency letter?

For a 510(k), an Additional Information letter typically gives 180 days to respond, and the review clock stays paused until you do. If you miss the deadline, the FDA can consider the submission withdrawn. Plan your response in the first week.

Got a deficiency letter now?

Book a discovery call or start with the free deficiency letter triage tool. We sign a mutual NDA first.