PreSTAR vs eSTAR: What Each FDA Template Is For

Published October 16, 2026

Most device teams meet these two templates months apart and assume they are unrelated. They are not. PreSTAR is where you ask the FDA whether your plan works. eSTAR is where you prove you followed it. If your cybersecurity approach is wrong, you want to find out in a Pre-Sub, when a change costs a few weeks, rather than in an Additional Information letter after you have filed, when the review clock stops and your launch date moves. This post explains what each template does, when you use each one, which is required, and how the cybersecurity questions you raise in a Pre-Sub should carry straight into the eSTAR cybersecurity section.

Why this matters

Section 524B of the FD&C Act requires cyber device submissions to include a plan for postmarket vulnerabilities, evidence of secure design processes, and a software bill of materials. The February 3, 2026 final premarket cybersecurity guidance, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions, describes what FDA guidance recommends: threat modeling, cybersecurity risk assessment, architecture views, an SBOM, and testing evidence such as penetration testing.

eSTAR builds those expectations into the form. When you say your device has software or connectivity, the template opens the cybersecurity attachment area and asks for that evidence. A gap there can turn into a deficiency.

A Pre-Sub through PreSTAR lets you settle the hard questions first: does the FDA see your product as a cyber device, is your threat model scope right, is your test plan enough for a novel interface? Getting written feedback on those points before you file is the main reason to use a Pre-Sub for cybersecurity.

Official sources: FDA eSTAR Program; FDA, Electronic Submission Template for Medical Device De Novo Requests; FDA, Electronic Submission Template for Medical Device Q-Submissions (draft, May 2025); FDA, Cybersecurity in Medical Devices (February 2026).

What is eSTAR?

eSTAR (electronic Submission Template And Resource) is an interactive PDF that guides you through preparing a marketing submission. It changes as you fill it in: answers about software, connectivity, or energy sources open the matching sections and attachment slots. It also shows you which required fields or attachments are still missing before you send it.

According to the FDA's eSTAR Program page, eSTAR is required for:

• 510(k) submissions to CDRH or CBER, unless exempted
• De Novo requests, as of October 1, 2025, unless exempted
• 510(k) and De Novo submissions for combination products sent to CDRH or CBER

The FDA also lists other submission types where eSTAR can be used voluntarily, including certain PMA submissions. Check the eSTAR Program page for the current list and template versions before you start.

What is PreSTAR?

PreSTAR (the Early Submission Requests eSTAR) is the same kind of interactive template, supporting Q-Submissions, certain IDE submissions, and 513(g) requests rather than marketing submissions. It looks and works like eSTAR, which is one reason teams like it: the format is familiar by the time they file.

The FDA's eSTAR Program page says PreSTAR is available for voluntary use. In its June 2026 update, the FDA added these Q-Submission types: Submission Issue Requests, Informational Meetings, Study Risk Determinations, PMA Day 100 Meetings, and Accessory Classification Requests. Pre-Submissions were already supported. PreSTAR 3.1 also supports voluntary IDE originals, supplements, and their amendments (not IDE reports), plus 513(g) requests. It is not limited to Q-Sub feedback.

[KEY REQUIREMENT] There is no current mandate to use PreSTAR. The FDA published a draft guidance in May 2025, Electronic Submission Template for Medical Device Q-Submissions. Draft guidance is not binding, but it signals where the FDA is heading, so plan for a possible future requirement.

PreSTAR vs eSTAR side by side

What cybersecurity questions belong in a Pre-Sub?

See also: eSTAR v7.1 Cybersecurity for IVDs vs nIVD Submissions, Mining FDA Databases for Cyber Precedent, and FDA 510(k) & PMA Cybersecurity Guide.

Pre-Sub questions get the most useful answers when they are specific and you tell the FDA what you plan to do. "Is our cybersecurity approach acceptable?" usually earns a general answer. Better questions look like these:

• Scope. "Our system includes a cloud dashboard that does not send commands to the device. We plan to include it in the threat model as an external system. Does the FDA agree?"
• Cyber device status. "The device has a USB service port and no wireless. We believe it meets the cyber device definition under Section 524B because it includes software and can connect to the internet through a service laptop. Does the FDA agree?"
• Testing. "We plan to pen test the device, mobile app, and cloud API, with an external firm, before submission. Is this scope enough for the wireless interface described in Attachment B?"
• Legacy components. "One third-party library has reached end of support. Here is our plan for compensating controls and monitoring. Is that approach acceptable?"

Send the threat model summary or architecture diagram as an attachment so the reviewer can answer against your actual design.

How Pre-Sub feedback carries into the eSTAR

The FDA's written feedback is part of the record. When you file the eSTAR, reviewers can check whether you did what you said you would. Three habits help:

1. Reference the Q-Sub number in your eSTAR and in the cybersecurity cover document.
2. Map each piece of feedback to an attachment. If the FDA asked for cloud API testing, point to the section of the pen test report that covers it.
3. Explain any changes. If the design changed after the Pre-Sub, say so and show how the threat model and testing were updated.

Our eSTAR 7.1 submission checklist and eSTAR software documents guide show what goes in each cybersecurity slot.

How Blue Goat approaches this

When a client plans a Pre-Sub, we start with a draft threat model and architecture views so the questions are grounded in the real system. We help write cybersecurity questions that state a proposed approach and ask for agreement, and we prepare the attachments the reviewer needs to answer them. After the meeting, we turn the FDA's feedback into a checklist that follows the work through testing and into the eSTAR cybersecurity section, so nothing agreed in the Pre-Sub gets lost. If the FDA sends cybersecurity questions after you file, we answer them at no extra cost.

FAQ

CTA

Planning a Pre-Sub and want your cybersecurity questions to get useful answers? Book a free discovery call. We'll review your device, suggest the questions worth asking, and show you how the answers feed your eSTAR. See our FDA premarket cybersecurity services and Blue Goat's eSTAR cybersecurity documentation support.