On this page
Published: · Updated:
Key Takeaways
- The sponsor initiates a SIR through the Q-Submission Program.
- The issue must arise from a qualifying FDA hold letter.
- A SIR is not appropriate while the file is under active review.
- The FDA does not use a SIR to pre-review a completed formal response for adequacy.
- The formal response remains due within the requested timeline, regardless of a SIR.
Part of our FDA cybersecurity deficiency, RTA, and hold-letter response series. For the full overview, start with FDA Deficiency Letter vs RTA vs Hold.
A Submission Issue Request (SIR) is a sponsor-initiated Q-Submission seeking FDA feedback on a proposed approach to issues in a qualifying hold letter. It is not an active-review eSTAR message and does not replace the formal response or extend its deadline.
A cybersecurity hold letter can leave a manufacturer uncertain about the right approach to a response. A SIR provides a way to discuss that proposed approach with the FDA. It is not the letter itself, and it is not a reviewer asking for a quick replacement attachment inside eSTAR.
Why This Matters
Confusing a feedback request with a formal deficiency response can leave the actual submission unanswered. The FDA's Q-Submission Program guidance, Section II.B explains the purpose and boundaries of a SIR. Use the actual letter and current program instructions to determine eligibility, submission mechanics, and deadlines.
What is an FDA Submission Issue Request?
A SIR requests written feedback or a meeting about a proposed approach to issues identified in specified hold letters. These include Additional Information Needed letters for 510(k)s, De Novo requests, and Duals. The purpose is to help the sponsor address the outstanding issues in the separate formal response.
The guidance says a SIR is not appropriate for a file under active review. Minor clarification during active review may instead be handled interactively with the lead reviewer. Do not assume that any reviewer email is a SIR or that a SIR can be filed through an eSTAR message field.
How is a SIR different from a deficiency letter or a new 510(k)?
| Item | Who initiates it | Purpose |
|---|---|---|
| FDA hold letter | The FDA | Identifies issues requiring a response |
| SIR | The sponsor | Seeks feedback on a proposed approach to qualifying hold-letter issues |
| Formal response | The sponsor | Addresses outstanding issues using the applicable submission process |
| New 510(k), where required | The manufacturer | Seeks clearance for a device or qualifying device change |
A SIR does not authorize a design change or decide whether a marketed-device modification requires a new submission. Assess changes under the applicable change guidance and the facts of the device. An SBOM revision or threat-model update alone does not establish the correct submission pathway. See Special vs Traditional 510(k) for cybersecurity changes and Letter to File vs new 510(k).
What cybersecurity questions might be suitable for discussion?
The following are hypothetical examples, not excerpts from FDA letters, frequency statistics, or prescribed evidence lists.
| Hypothetical hold-letter issue | Proposed approach to discuss | Possible supporting material |
|---|---|---|
| Unclear component vulnerability impact | Explain the device-specific assessment and planned remediation | Component identification, affected code paths, risk analysis, and optional VEX |
| Incomplete threat-model explanation | Explain how the model will be revised for the device architecture | Data flows, trust boundaries, threats, and control traceability |
| Unclear penetration-test coverage | Explain proposed scope or exclusions | Interface inventory, test plan, and reasoned exclusions |
| Insufficient vulnerability-handling detail | Explain planned process updates | Responsibilities, monitoring, triage, disclosure, and update arrangements |
Tailor supporting materials to the issue. The Q-Submission guidance does not mandate these artifacts, fixed SBOM formats, a specific threat-model method, or VEX. For the underlying technical recommendations, consult the February 3, 2026 cybersecurity guidance.
How should a sponsor prepare a SIR request?
- Identify the qualifying hold letter and the specific unresolved issue.
- Explain the proposed approach, its rationale, and the questions on which feedback is needed.
- Supply relevant supporting information without asking the FDA to pre-review a completed formal response.
- Confirm current Q-Submission instructions with the regulatory lead.
- Continue preparing the separate formal response against its actual deadline.
Do not assume a five-day response target, a particular fee, automatic approval, or a deadline extension from this article. Those claims are not established by the cited SIR guidance.
Illustrative discussion outline
This is a sponsor-side organizational aid, not an FDA form or an eSTAR response field.
Relevant submission: [identifier]
Qualifying hold letter: [date and reference]
Issue for discussion: [specific issue in the letter]
Proposed approach: [planned work and rationale]
Supporting information: [files, versions, and relevant sections]
Questions for FDA feedback: [focused questions about the approach]
Formal response deadline: [from the applicable letter and guidance]
Q-Submission reference: [once assigned]
Worked example: a vulnerability assessment question
Suppose a qualifying hold letter asks for a clearer assessment of a software component vulnerability. The sponsor proposes to identify the exact component and build, examine the vulnerable code path, assess device impact, and determine whether a patch or other control is needed.
A useful discussion question might be: “Does this proposed assessment approach address the concern identified in the letter, or is additional analysis needed?” Supporting information might include the affected architecture, planned test scope, and a risk-analysis outline.
See also: Breakthrough Device Designation and Cybersecurity, Q-Sub vs Pre-Sub: FDA Cybersecurity Guide, and Docker Containers in Medical Devices: FDA Testing.
This hypothetical example does not assert a real CVE's exploitability, prescribe a CVSS score, establish unchanged residual risk, or promise acceptance. A scanner result or a standard citation alone does not prove that the vulnerability is fixed. An optional VEX statement requires product-specific evidence and manufacturer review.
Evidence traceability without unsupported claims
A traceability table can connect each statement to its evidence. It is an optional organizational aid, not a guarantee of faster review.
| Proposed statement | Evidence needed | Responsibility |
|---|---|---|
| The identified component was replaced | Build identity and component-change records | Engineering |
| The affected path was assessed | Device-specific analysis and relevant test results | Product security |
| Residual risk was evaluated | Documented risk analysis and authorized decision | Manufacturer risk owner |
| The documents match the assessed build | Version-controlled records and cross-checks | Quality and regulatory teams |
Citations establish context. Device records establish what was done. Do not substitute one for the other.
How Blue Goat Cyber Approaches This
Blue Goat Cyber supports device-specific cybersecurity evidence review, threat modeling, SBOM work, and penetration testing. We can help organize technical findings and supporting evidence for a manufacturer's regulatory response, with scope and timing agreed for the engagement. The manufacturer and its regulatory team own the submission strategy and approvals.
See our FDA cybersecurity deficiency-response service or full-service premarket support. If the FDA raises a cybersecurity question, we answer it at no extra cost until the cybersecurity portion is closed.
FAQ
Is a SIR a reviewer message in eSTAR?
No. It is a sponsor-initiated Q-Submission seeking feedback on a proposed approach to issues in a qualifying hold letter.
Can we use a SIR during active review?
The Q-Submission guidance says a SIR is not appropriate while the file is under active review. Discuss minor clarification with the lead reviewer through the applicable interactive process.
Does a SIR extend the formal response deadline?
No. Prepare the formal response within the requested timeline regardless of the SIR. Confirm the applicable deadline in the letter and program guidance.
Can the FDA pre-review our completed response through a SIR?
The guidance says a SIR is not intended to pre-review a formal response for adequacy. Focus on questions about the proposed approach.
Does changing the SBOM automatically require a Special 510(k)?
No. Evaluate the actual device change under applicable change guidance. A documentation update alone does not determine the submission route.
Related reading
Deficiency-letter cluster:
- FDA Deficiency Letter vs RTA vs Hold Letter
- How to respond to an FDA cybersecurity AI request
- FDA cybersecurity major vs minor deficiency
- What triggers FDA cybersecurity deficiencies for devices
- 510(k) cybersecurity deficiencies that trigger FDA holds
- PMA cybersecurity deficiencies and complete response letters
- FDA 483 cybersecurity observations under QMSR
- VEX mistakes that trigger FDA deficiencies
Related cybersecurity submission topics:
- Preparing your eSTAR 510(k) cybersecurity documentation
- eSTAR cybersecurity: IVD vs non-IVD submissions
- Special vs Traditional 510(k) for cybersecurity changes
- Letter to File vs new 510(k) for cybersecurity changes
- 510(k) cybersecurity requirements every maker must meet
Discuss your cybersecurity response
Contact Blue Goat Cyber to discuss the technical evidence and scope of support.
About the author. Christian Espinosa is the founder and CEO of Blue Goat Cyber. Read his biography.
About the author
Christian Espinosa, MBA · Founder & CEO, Blue Goat Cyber
U.S. Air Force Academy graduate and veteran with 30+ years in cybersecurity. Founded Alpine Security in 2014 (acquired 2020), then Blue Goat Cyber in 2022. Blue Goat track record: 275+ FDA submissions supported, zero cybersecurity rejections. Author of three books including The Smartest Person in the Room. Ironman triathlete and mountaineer.
Sources & references
Primary sources cited in this article. Links open in a new tab.