FDA· Jun 3, 2026
SBOM Diffing & CVE Correlation Postmarket
How to operationalize SBOM diffing and CVE correlation across releases so postmarket vulnerability monitoring holds up under FDA Section 524B and the Feb.
Read articleEvery article in our archive tagged Primer.
Looking for a quick answer instead? The FDA medical device cybersecurity FAQ covers Section 524B scope, SBOMs, threat models, CR515 and GMLP, deficiencies, and postmarket duties.
Showing 12 of 99 articles tagged Primer · Page 2 of 9
How to operationalize SBOM diffing and CVE correlation across releases so postmarket vulnerability monitoring holds up under FDA Section 524B and the Feb.
Read article
How the FDA distinguishes Major from Minor cybersecurity deficiencies in 510(k) and PMA reviews, the response-window difference, and how to keep findings.
Read article
Which PMA submission type a cybersecurity change requires - 180-day supplement, Real-Time, Special, 30-day notice, or annual report - and the decision.
Read article
De Novo cybersecurity requirements under Section 524B: the documentation set, why no predicate raises the bar, and how special controls affect your evidence.
Read article
IEC 81001-5-1 explained: scope, mapping to AAMI SW96 and TIR57, what the FDA recognizes, and what evidence each standard produces for submissions.
Read article
Illustrative BLE/RF penetration-testing scenarios for a connected Class II medical device. Aligned with the FDA's Feb 3, 2026 premarket cybersecurity.
Read article
Where CAN/CANopen shows up inside medical devices, the attack paths reviewers want modeled, and the controls that actually hold up under pen test.
Read article
What CVSS is, how the 0-10 CVSS scale works, how 3.1 and 4.0 scoring differ, and why medical device triage adds EPSS, KEV, and patient-safety context.
Read article
Medical device cybersecurity relies on AAMI TIR57, TIR97, and SW96. Understand their applications, FDA recognition, and how to use them for compliance.
Read article
Learn the actual timelines for FDA cybersecurity review. Understand 510(k) and De Novo clock stops, RTA hold periods, and how to avoid costly delays.
Read article
The four cybersecurity deficiency patterns the FDA flags most often in 510(k) submissions - incomplete SBOMs, thin threat models, scoped-down pen tests.
Read article
Understand whether to hire a medical device security consultant or build an in-house team. Evaluate costs, FDA expertise, and submission timelines.
Read article30-minute strategy session. No cost, no commitment - just answers from people who've shipped 275+ devices supported.