Medical Device Security Advisor: After FDA Clearance

Reviewed October 14, 2026

Clearance feels like the finish line. For cybersecurity, it is closer to the start. The documents you filed describe the device on the day you submitted it, and every release, new component, and newly published vulnerability makes them less accurate.

The law expects you to keep up. Section 524B of the FD&C Act requires makers of cyber devices to monitor and address vulnerabilities after launch and to provide updates and patches. The FDA's December 2016 final guidance, Postmarket Management of Cybersecurity in Medical Devices, is still the agency's dedicated postmarket guidance.

Most device companies do not have a full-time product security lead to own this. A medical device security advisor fills that gap on a retainer, and this post explains what that work looks like week to week.

Why This Matters

Section 524B took effect on March 29, 2023. For any cyber device, it requires a plan to monitor, identify, and address postmarket vulnerabilities, a process to provide updates and patches, and a software bill of materials. Those duties do not end when the clearance letter arrives.

The FDA's postmarket expectations are set out in the December 28, 2016 final guidance, Postmarket Management of Cybersecurity in Medical Devices. It asks manufacturers to judge whether a vulnerability poses an uncontrolled or controlled risk to patients and to respond accordingly. The February 3, 2026 premarket guidance, Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions, adds that the plans you file should describe how you will actually run this work.

Hospitals add their own pressure. Many ask for an MDS2 form, an SBOM, and answers to long security questionnaires before they buy or renew.

The standards behind this work include ANSI/AAMI SW96:2023 and AAMI TIR57 for security risk management, IEC 81001-5-1 for the secure product lifecycle, and ISO 14971 for patient safety risk. Keeping all of them aligned after launch is where most teams fall behind.

Official sources: FDA, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026); CISA Software Bill of Materials resources; HHS HIPAA for Professionals; CISA Cybersecurity Advisories (including ICS medical advisories).

What changes after clearance?

The device keeps changing, and so does the world around it. Engineering ships fixes and features, third-party libraries publish new versions, and researchers find new weaknesses in components you already use.

Each of those events can make your filed evidence wrong. The threat model may miss a new interface. The SBOM may list an old version. The risk file may rate a threat that is now easier to exploit.

What does the advisor do each week?

The advisor spends the retainer on whatever matters most that week. The most common work falls into four groups.

You get a short written summary each week of what was done and what comes next. That record is useful evidence on its own when the FDA or an auditor asks how you run postmarket cybersecurity.

How are new vulnerabilities handled?

Every relevant vulnerability gets a patient-harm rating before anyone decides what to do. A high CVSS score on a component nobody can reach may matter less than a medium score on the Bluetooth stack.

The advisor checks whether the vulnerable code is present and reachable, ties the threat to a hazard in your ISO 14971 file, and recommends a response. That might be a routine patch, a faster fix with a customer notice, or a documented decision that no action is needed. If outside researchers report an issue, the advisor helps run coordinated disclosure.

How does the advisor help with hospitals?

See also: CISA KEV Catalog: Prioritize Device Risk, Hospital Security Questions for AI Medical Devices: Answers, and SBOM for SaMD and Cloud Components: FDA Guide.

Hospital security reviews go faster when the answers already exist. The advisor answers questionnaires and keeps the MDS2 form and SBOM current, using the same evidence you gave the FDA.

That consistency matters. When a hospital's answers and your FDA file disagree, the review stalls while someone works out which one is right. See passing hospital security reviews for the wider process.

When does a change need a new submission?

Some changes can be documented in a letter to file, and others need a new 510(k). The advisor reviews each planned change for its security impact and flags when it may cross that line, so your regulatory team can decide early.

A Predetermined Change Control Plan can cover some planned changes in advance. The advisor makes sure each change in the plan carries its security analysis and tests. See letter to file vs new 510(k) for cybersecurity changes for the decision in detail.

Advisor, project, or full-time hire?

Each option fits a different need. Projects suit one clear deliverable, a full-time hire suits large portfolios, and an advisor suits steady work that needs senior judgment but not 40 hours a week.

Need ongoing help after clearance? Our medical device security advisory puts a senior advisor on your team every week.

How Blue Goat Cyber Approaches This

Blue Goat Cyber works only on medical device cybersecurity and has supported 275+ devices. Our MedTech Cybersecurity Advisory is a monthly retainer, starting at $5,000 a month, with a named senior advisor who learns your device and stays with it.

Onboarding starts with your threat model, SBOM, risk file, and open questions. From there, the advisor joins your Slack and meetings, works the most important items each week, and sends a short written summary. Larger work, such as a penetration test, a full premarket package, or a deficiency response, is scoped separately as a fixed-fee project, so the retainer stays free for weekly work.

The focus is the product: the device, its apps, and its cloud service. We do not run corporate IT security, and the service is not a CISO. If the FDA raises cybersecurity deficiencies after our submission, we resolve them at no additional cost.

Related reading: SBOM for SaMD and Cloud Components: What the FDA Expects in 2026.

Frequently Asked Questions

What does a medical device security advisor do after FDA clearance?

They keep your cybersecurity evidence accurate as the device changes. That includes updating the threat model and SBOM after releases, rating new vulnerabilities for patient harm, recommending patch and customer-notice decisions, answering hospital security questionnaires, and flagging changes that may need a new submission. The work is weekly and ongoing, done by someone who already knows your device.

Is a medical device security advisory the same as a CISO?

No. A CISO protects a company's own networks, laptops, and email. A medical device security advisory protects the product: the device, its apps, and its cloud service, plus the evidence the FDA and hospitals expect for them. Many device companies need product security help long before they need, or can afford, a corporate security leader.

Do we still need postmarket cybersecurity work if the device is already cleared?

Yes. This is a common misconception. Section 524B requires makers of cyber devices to monitor and address vulnerabilities and to provide updates and patches after launch. Clearance confirms your plans; it does not finish the work. New vulnerabilities in your components appear every month, and the FDA expects you to respond to them.

How much does a medical device security advisory cost?

Blue Goat Cyber's MedTech Cybersecurity Advisory starts at $5,000 a month, billed as a fixed monthly retainer. Penetration tests, full premarket packages, and deficiency responses are scoped separately as fixed-fee projects. The retainer covers weekly advisory work, file upkeep, vulnerability review, and answers to FDA and hospital questions.

Can an advisor help with our next submission?

Yes. Because the files stay current, the cybersecurity part of a new 510(k), De Novo, PMA, or PCCP change starts from accurate documents instead of a rebuild. The advisor drafts the security content and scopes any testing you need. That usually shortens preparation and reduces the chance of cybersecurity questions from the FDA.

CTA

Want a senior device security advisor on your team every week after clearance? Book a free discovery call and we will review your device, files, and open questions, then confirm whether the retainer fits. If the FDA raises cybersecurity deficiencies after our submission, we resolve them at no additional cost. Book a discovery call.