PreSTAR vs eSTAR: What Each FDA Template Is For

Published October 16, 2026

Most device teams meet these two templates months apart and assume they are unrelated. They are not. PreSTAR is where you ask the FDA whether your plan works. eSTAR is where you prove you followed it. If your cybersecurity approach is wrong, you want to find out in a Pre-Sub, when a change costs a few weeks, rather than in an Additional Information letter after you have filed, when the review clock stops and your launch date moves. This post explains what each template does, when you use each one, which is required, and how the cybersecurity questions you raise in a Pre-Sub should carry straight into the eSTAR cybersecurity section.

Why this matters

Section 524B of the FD&C Act requires cyber device submissions to include a plan for postmarket vulnerabilities, evidence of secure design processes, and a software bill of materials. The February 3, 2026 final premarket cybersecurity guidance, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions, describes what the FDA expects to see: threat modeling, cybersecurity risk assessment, architecture views, an SBOM, and testing evidence such as penetration testing.

eSTAR builds those expectations into the form. When you say your device has software or connectivity, the template opens the cybersecurity attachment area and asks for that evidence. A gap there can turn into a deficiency.

A Pre-Sub through PreSTAR lets you settle the hard questions first: does the FDA see your product as a cyber device, is your threat model scope right, is your test plan enough for a novel interface? Getting written feedback on those points before you file is the main reason to use a Pre-Sub for cybersecurity.

Official sources: FDA eSTAR Program; FDA, Electronic Submission Template for Medical Device De Novo Requests; FDA, Electronic Submission Template for Medical Device Q-Submissions (draft, May 2025); FDA, Cybersecurity in Medical Devices (February 2026).

What is eSTAR?

eSTAR (electronic Submission Template And Resource) is an interactive PDF that guides you through preparing a marketing submission. It changes as you fill it in: answers about software, connectivity, or energy sources open the matching sections and attachment slots. It also shows you which required fields or attachments are still missing before you send it.

According to the FDA's eSTAR Program page, eSTAR is required for:

• 510(k) submissions to CDRH or CBER, unless exempted
• De Novo requests, as of October 1, 2025, unless exempted
• 510(k) and De Novo submissions for combination products sent to CDRH or CBER

The FDA also lists other submission types where eSTAR can be used voluntarily, including certain PMA submissions. Check the eSTAR Program page for the current list and template versions before you start.

What is PreSTAR?

PreSTAR (the Early Submission Requests eSTAR) is the same kind of interactive template, built for Q-Submissions instead of marketing submissions. It looks and works like eSTAR, which is one reason teams like it: the format is familiar by the time they file.

The FDA's eSTAR Program page says PreSTAR is available for voluntary use. In its June 2026 update, the FDA added these Q-Submission types: Submission Issue Requests, Informational Meetings, Study Risk Determinations, PMA Day 100 Meetings, and Accessory Classification Requests. Pre-Submissions were already supported.

[KEY REQUIREMENT] There is no current mandate to use PreSTAR. The FDA published a draft guidance in May 2025, Electronic Submission Template for Medical Device Q-Submissions. Draft guidance is not binding, but it signals where the FDA is heading, so plan for a possible future requirement.

PreSTAR vs eSTAR side by side

What cybersecurity questions belong in a Pre-Sub?

See also: eSTAR v7.1 Cybersecurity for IVDs vs nIVD Submissions, Mining FDA Databases for Cyber Precedent, and eSTAR 510(k) Cybersecurity Documentation.

Pre-Sub questions get the most useful answers when they are specific and you tell the FDA what you plan to do. "Is our cybersecurity approach acceptable?" usually earns a general answer. Better questions look like these:

• Scope. "Our system includes a cloud dashboard that does not send commands to the device. We plan to include it in the threat model as an external system. Does the FDA agree?"
• Cyber device status. "The device has a USB service port and no wireless. We believe it meets the cyber device definition under Section 524B because it includes software and can connect to the internet through a service laptop. Does the FDA agree?"
• Testing. "We plan to pen test the device, mobile app, and cloud API, with an external firm, before submission. Is this scope enough for the wireless interface described in Attachment B?"
• Legacy components. "One third-party library has reached end of support. Here is our plan for compensating controls and monitoring. Is that approach acceptable?"

Send the threat model summary or architecture diagram as an attachment so the reviewer can answer against your actual design.

How Pre-Sub feedback carries into the eSTAR

The FDA's written feedback is part of the record. When you file the eSTAR, reviewers can check whether you did what you said you would. Three habits help:

1. Reference the Q-Sub number in your eSTAR and in the cybersecurity cover document.
2. Map each piece of feedback to an attachment. If the FDA asked for cloud API testing, point to the section of the pen test report that covers it.
3. Explain any changes. If the design changed after the Pre-Sub, say so and show how the threat model and testing were updated.

Our eSTAR 7.1 submission checklist and eSTAR software documents guide show what goes in each cybersecurity slot.

How Blue Goat approaches this

When a client plans a Pre-Sub, we start with a draft threat model and architecture views so the questions are grounded in the real system. We help write cybersecurity questions that state a proposed approach and ask for agreement, and we prepare the attachments the reviewer needs to answer them. After the meeting, we turn the FDA's feedback into a checklist that follows the work through testing and into the eSTAR cybersecurity section, so nothing agreed in the Pre-Sub gets lost. If the FDA sends cybersecurity questions after you file, we answer them at no extra cost.

FAQ

Is PreSTAR mandatory?

No. The FDA's eSTAR Program page lists PreSTAR as available for voluntary use. The FDA issued a draft guidance in May 2025 on an electronic template for Q-Submissions, which could lead to a future requirement, but draft guidance is not binding. Check the FDA's eSTAR Program page for the current status before you submit a Pre-Sub.

Is eSTAR required for a 510(k)?

Yes. eSTAR has been required for 510(k) submissions to CDRH and CBER since October 2023, unless the submission is exempted. De Novo requests have also required eSTAR since October 1, 2025. Using the wrong format can delay acceptance, so download the current template version from the FDA before you start.

Can I use PreSTAR for a Pre-Sub about cybersecurity only?

Yes. A Pre-Sub can focus on any topic where you want FDA feedback, including cybersecurity. Teams with a novel interface, a cloud component, or unclear cyber device status often ask cybersecurity questions alongside their other topics. Keep the questions specific and attach the design information the reviewer needs to answer them.

Does a Pre-Sub guarantee the FDA will accept my cybersecurity approach?

No. Pre-Sub feedback reflects the information you provided at the time, and it is not a decision on your submission. It does reduce surprises. If you follow the feedback and document how you did, reviewers have a clear record of what was agreed, and any design changes since then should be explained in the eSTAR.

Where do I download PreSTAR and eSTAR?

Both templates are on the FDA's eSTAR Program page, which also lists the current versions. You fill them in with Adobe Acrobat and send them through the CDRH Portal. Always use the current version, because the FDA updates the templates when guidance changes.

CTA

Planning a Pre-Sub and want your cybersecurity questions to get useful answers? Book a free discovery call. We'll review your device, suggest the questions worth asking, and show you how the answers feed your eSTAR. See our FDA premarket cybersecurity services.