Every article in our archive tagged Section 524B.
Section 524B of the Federal Food, Drug, and Cosmetic Act is the law that makes cybersecurity a submission requirement. It applies to any "cyber device": a device that includes software, can connect to the internet, and could be vulnerable to cybersecurity threats. Manufacturers of these devices must include a plan to monitor and address postmarket vulnerabilities, show secure design and maintenance processes, provide updates and patches, and submit a software bill of materials (SBOM).
The law sets the requirement. The FDA's February 3, 2026 premarket cybersecurity guidance explains what the agency expects to see as evidence. The articles below cover whether 524B applies to your device, what each subsection asks for, and how teams document it in 510(k), De Novo, and PMA submissions.
Looking for a quick answer instead? The FDA medical device cybersecurity FAQ covers Section 524B scope, SBOMs, threat models, CR515 and GMLP, deficiencies, and postmarket duties.
Showing 12 of 45 articles tagged Section 524B · Page 1 of 4
Medical device cybersecurity should scale with device risk. Christian Espinosa argues why meeting only the Section 524B minimum leaves patients and submissions exposed.
Read article
Medical device cybersecurity for nanotech neurostimulation: a fictional STRIDE threat model linking controller risks, patient harms, controls, and testing.
Read article
Threat modeling AI-enabled medical devices: how to add the model, training pipeline, and updates to your threat model, with a worked example of a fictional AI dosing advisor.
Read article
AI training data security for medical devices: how to track where data comes from, control who can change it, and show the FDA your training pipeline is protected.
Read article
AI model integrity for medical devices: how to stop model files from being stolen or swapped, sign model updates, and show the FDA the model that runs is the one you validated.
Read article
What investors ask medical device founders about cybersecurity during a raise, what good answers look like, and how to prepare a diligence-ready package.
Read article
CLIA-waived test cybersecurity: why point-of-care devices used by untrained staff need strong security, and what the FDA expects in the premarket submission.
Read article
Ransomware and medical devices: how attacks reach connected devices, what the FDA's 2026 premarket guidance expects, and the design controls that limit harm.
Read article
SBOM for SaMD and cloud components: what the FDA expects for cloud services, containers, and third-party APIs, and how to keep the SBOM current after release.
Read article
What is a cyber device under FDA Section 524B? The three-part legal test, how the FDA reads internet connection, and a quick check for your own device.
Read article
Home use vs hospital device cybersecurity: which controls the HDO environment provides, which the device must carry itself, and how the FDA reviews each case.
Read article
How your Indications for Use statement and predicate choice change the cybersecurity scope of a 510(k): use environment, harm ceiling, pen test scope, and Special 510(k) eligibility.
Read article30-minute strategy session. No cost, no commitment - just answers from people who've shipped 275+ devices supported.
