Premarket cybersecurity for FDA submissions

What you need to know

Premarket cybersecurity is the documentation you submit to the FDA before a device can be cleared or approved. Reviewers look for a threat model, a cybersecurity risk assessment, an architecture view, an SBOM, penetration and security testing evidence, labeling, and a postmarket plan. Missing or weak pieces are among the most common reasons for deficiency letters.

The articles below explain what the FDA's February 3, 2026 guidance asks for, how expectations change between 510(k), De Novo, and PMA, how much the work typically costs, and how to tell whether a device change needs a new submission.