510(k) vs De Novo vs PMA: How FDA Cybersecurity Requirements Differ
Assuming a pathway needs less cybersecurity evidence than it does is a common source of FDA questions and delays. This 510k vs PMA vs De Novo comparison is based on the FDA's final guidance, "Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions," issued February 3, 2026, and on Blue Goat Cyber's work across more than 275 device submissions on all three pathways. It covers what each pathway is, what the FDA expects for cybersecurity in each, and where teams most often get caught out.
Key takeaways
- All three pathways require the same core Section 524B package for a cyber device: SPDF documentation, SBOM, threat model, architecture views, testing and a postmarket plan.
- The depth of evidence scales with device risk; PMA is the most demanding.
- A 510(k) is compared with a predicate, but the predicate's cybersecurity evidence does not carry over to your device.
- De Novo submissions need a defensible risk rationale because there is no predicate.
- eSTAR has been required for 510(k)s since October 1, 2023 and for De Novo requests since October 1, 2025.
- Our no-extra-cost commitment on FDA cybersecurity deficiencies covers all three pathways.
What are the three FDA submission pathways?
510(k), De Novo, and PMA are the three main FDA premarket pathways, distinguished by device risk and the evidence each demands. Device class drives the choice: most Class II devices, and some Class I, use a 510(k); new low to moderate risk devices without a predicate use De Novo; Class III devices use PMA.
510(k). You show that your device is substantially equivalent to a legally marketed device, called the predicate, with the same intended use and similar technology. It is the most common route for connected devices.
De Novo. For a new type of low to moderate risk device with no predicate. If granted, the FDA creates a new classification with special controls, and your device becomes a predicate for later 510(k)s.
PMA. For high-risk Class III devices, such as those that support or sustain life. You must provide valid scientific evidence, usually including clinical data, that the device is safe and effective.
An IDE, covered in the full table further down, comes before a marketing submission when a significant-risk device needs a clinical study. It is not a fourth marketing pathway.
Cybersecurity depth by pathway
| Item | 510(k) | De Novo | PMA |
|---|---|---|---|
| SPDF documentation | Required. Reviewers check that your secure development process actually ran on this device, not just that a policy exists. | Required, with more attention because there is no predicate to compare against. | Required and read closely alongside quality system evidence. |
| SBOM | Required in machine-readable form, with support status and end-of-support dates for each component. | Same content as a 510(k). | Same content, often with more components and closer questions on unsupported software. |
| Threat model | Required for this device. A predicate's threat model does not carry over. | Required, and it shapes the special controls later devices will follow. | Required, usually covering a larger system and more clinical harm scenarios. |
| Penetration testing depth | Manual testing of every interface the device exposes, sized to its connectivity. | Same approach; reviewers expect a clear link from test scope to the threat model. | Deepest testing, commonly across firmware, wireless, apps and cloud. |
| Security architecture views | Required: global system, multi-patient harm, updatability and security use case views. | Same views; they help justify why a new device type is safe. | Same views, typically at greater detail. |
| Typical review scrutiny | Format and completeness are checked early; gaps often surface as a hold. | Reviewers look for a defensible risk rationale for a new device type. | The most detailed review, often with multiple rounds of questions. |
| Postmarket obligations | Vulnerability monitoring, disclosure process and SBOM updates. | Same as a 510(k). | Same, plus cybersecurity changes addressed in PMA annual reports or supplements. |
The most important difference: the list of documents does not change between pathways, only how deeply the FDA reads them. Need help sizing yours? See FDA premarket cybersecurity services.
How cybersecurity differs for a 510(k)
A 510(k) compares your device with a predicate, but cybersecurity evidence does not transfer from the predicate to your device.
- Predicate parity has limits. Substantial equivalence covers intended use and technology. The FDA still expects cybersecurity evidence for your device's actual design.
- Full 524B artifacts are still expected. If your device is a cyber device, the submission needs its own threat model, SBOM, architecture views, testing and postmarket plan, in the eSTAR cybersecurity section.
- Common pitfalls. Relying on a predicate cleared before Section 524B took effect in March 2023; an SBOM without support status or end-of-support dates; test reports that never trace back to the threat model.
- Early checks. Missing or incomplete cybersecurity content can be caught in the FDA's early acceptance or technical screening, before substantive review starts.
See 510(k) cybersecurity requirements.
How cybersecurity differs for a De Novo
With no predicate to compare against, a De Novo has to stand on its own risk rationale.
- A defensible risk rationale. The submission must explain why the device's cybersecurity risks are reasonably controlled, without leaning on an existing device.
- Special controls. A granted De Novo sets special controls for the new device type. Where cybersecurity matters to safety, it belongs in those controls, which later 510(k)s will follow.
- Documentation depth. Reviewers look closely at the reasoning behind each risk decision and how testing covers the threat model.
- eSTAR. De Novo requests have used eSTAR since October 1, 2025, so cybersecurity content follows the same structured format as a 510(k).
See the De Novo cybersecurity submission guide.
How cybersecurity differs for a PMA
PMA devices carry the highest risk, so the FDA reads the cybersecurity package most closely.
- The deepest scrutiny. Expect more detailed questions on architecture, risk assessment and residual risk than on other pathways.
- Testing rigor. Penetration testing usually covers more ground, such as firmware, wireless, apps and cloud, with results traced to the threat model.
- Quality system ties. Cybersecurity evidence connects to design controls and manufacturing records, which the FDA may review.
- Postmarket obligations. After approval, some cybersecurity changes need a PMA supplement, and others are reported in the PMA annual report.
See PMA cybersecurity requirements.
How Blue Goat Cyber handles all three pathways
Blue Goat Cyber builds the same core Section 524B package for every pathway, then sizes the depth of testing and documentation to what that pathway's reviewers expect. For a 510(k), that means making sure nothing is assumed from the predicate. For a De Novo, it means a risk rationale strong enough to support new special controls. For a PMA, it means deeper testing and evidence that fits your quality system records. Our US-based team of employees has supported more than 275 device submissions across 510(k), De Novo, and PMA, and most of our testing is manual work by senior engineers. Engagements are fixed fee with retests included. If the FDA raises cybersecurity deficiencies after our submission, we resolve them at no additional cost to you, across all submission pathways: 510(k), De Novo, and PMA. Learn more about our FDA premarket cybersecurity services.
Full pathway comparison, including IDE
| Dimension | 510(k) | De Novo | PMA | IDE |
|---|---|---|---|---|
| Statutory/regulatory basis | 21 USC 360(k); 21 CFR Part 807, Subpart E. | FD&C Act 513(f)(2); 21 CFR Part 860, Subpart D. | FD&C Act §515; 21 CFR Part 814. | FD&C Act 520(g); 21 CFR Part 812. |
| Typical device class | Class II (some Class I). | Novel low/moderate risk (Class I or II) with no predicate. | Class III (high risk, life-supporting/sustaining). | Significant-risk investigational devices (any class) entering a clinical study. |
| Cybersecurity statutory hook | Section 524B applies in full. | Section 524B applies in full. | Section 524B applies in full. | Section 524B(a) does NOT enumerate IDE - it is a marketing-submission statute. Cybersecurity expectations come from the FDA's Feb 3, 2026 final premarket guidance, plus unreasonable-risk-to-subjects review under 21 CFR §812.30(b)(4). |
| Cybersecurity submission format | eSTAR cybersecurity section (mandatory since Oct 2023). | eSTAR cybersecurity section (mandatory since Oct 1, 2025). | PMA modular content; cybersecurity package per 2026 guidance. | IDE application cybersecurity sections; eCopy or CDRH portal upload (no eSTAR yet). |
| Required artifacts (2026 guidance) | SPDF documentation, threat model, SBOM, security architecture views, risk assessment, pen test, postmarket plan, labeling. | Same core package as a 510(k); plus cybersecurity reflected in the proposed special controls where relevant. | Same core package; plus deeper architecture, manufacturing, and quality-system evidence. | Threat model, security risk assessment, SBOM, architecture views, pen-test evidence sized to investigational risk, mid-study monitoring plan. |
| Review clock | 90 FDA days (substantive review). | 150 FDA days. | 180 FDA days; can be longer with panel review. | 30 FDA days; the study may begin if FDA does not place it on hold within that window. |
| Highest-severity cyber outcome | Refuse to accept, or a hold while you answer an Additional Information request. | Refuse to accept, or a hold while you answer an Additional Information request. | Refuse to file, or a major deficiency letter that stops the review clock. | Clinical Hold under 21 CFR §812.42 - stops enrollment until cybersecurity concerns are resolved. |
| Postmarket cyber expectations | Postmarket plan + CVD process + SBOM updates. | Same as 510(k). | Same plus PMA annual reports must address cybersecurity changes. | Mid-study security event reporting to investigators / IRB / FDA; IDE supplements for security patches and scope changes. |
How to tell which pathway applies
- 510(k) if a legally marketed predicate exists with the same intended use and similar technology. Most connected Class II devices go this way.
- De Novo if the device is new, has no predicate, and is low to moderate risk. A granted De Novo becomes a predicate for later 510(k)s.
- PMA for Class III devices that support or sustain life or present high risk, where clinical evidence of safety and effectiveness is required.
- IDE when a significant-risk device needs a clinical study before a marketing submission. It comes before one of the three above, not instead of it.
If you are unsure, a Pre-Submission (Q-Sub) lets you ask the FDA directly, and it is a good place to confirm cybersecurity expectations too.
Timeline and cost: what actually drives them
The review clocks in the table are FDA days. Calendar time is longer, because the clock stops whenever the FDA sends questions and waits for your answer. For cybersecurity, the biggest schedule risk is an incomplete package that triggers a hold or deficiency letter, which can add months.
- FDA user fees rise sharply from 510(k) to De Novo to PMA and change every fiscal year. Check the current amounts on the FDA MDUFA user fee page. Small businesses can qualify for reduced fees.
- Cybersecurity work is similar in kind across all three pathways (threat model, risk assessment, SBOM, architecture views, penetration test, postmarket plan). Effort grows with device complexity and connectivity more than with the pathway. See what medical device cybersecurity costs.
- Penetration testing for a simple device typically starts around $15k, with no travel and a reasonable turnaround. See our FDA penetration testing service.
Cybersecurity mistakes that stall each pathway
- 510(k): assuming the predicate's clearance covers cybersecurity. If the predicate was cleared before Section 524B, you still owe the full package.
- De Novo: leaving cybersecurity out of the proposed special controls, which later 510(k)s will rely on.
- PMA: forgetting that cybersecurity changes after approval may need a PMA supplement or must be reported in the annual report.
- IDE: treating an investigational device as exempt. Section 524B does not list IDEs, but the FDA's 2026 guidance still applies and weak security can support a clinical hold.
Frequently asked questions
Do 510(k), De Novo, and PMA submissions have different cybersecurity requirements?
The required documents are the same across all three: an SPDF, SBOM, threat model, architecture views, testing and a postmarket plan. What changes is the depth. PMA gets the deepest scrutiny, De Novo needs a defensible rationale for a new device type, and a 510(k) is compared with its predicate.
Does a 510(k) need the same cybersecurity documentation as a PMA?
Yes, the same set of documents. A 510(k) package is usually smaller because the device is typically less complex, but it cannot skip the threat model, SBOM or testing. Relying on the predicate's clearance is a common mistake, especially when the predicate was cleared before Section 524B.
Which pathway has the strictest cybersecurity review?
PMA has the most detailed review because the devices are high risk. That said, 510(k) submissions are often stopped earliest, because missing or badly organized cybersecurity content is caught before substantive review begins.
Does the deficiency commitment cover all three pathways?
Yes. If the FDA raises cybersecurity deficiencies after our submission, we resolve them at no additional cost to you, across all submission pathways: 510(k), De Novo, and PMA.
We are not sure which pathway applies. Can you help?
Yes. The pathway does not change whether Section 524B applies to a cyber device, only how deep the evidence needs to be. We can help you plan the cybersecurity work and, if needed, prepare questions for a Pre-Submission. See our FDA premarket cybersecurity services.
Planning a submission on any pathway?
Whichever pathway your device takes, the cybersecurity package is the same set of documents, sized to the right depth. If the FDA raises cybersecurity deficiencies after our submission, we resolve them at no additional cost to you, across all submission pathways: 510(k), De Novo, and PMA. Explore FDA premarket cybersecurity services.
About the author. Christian Espinosa, is the founder and CEO of Blue Goat Cyber. He has worked on medical device cybersecurity submissions across the 510(k), De Novo, and PMA pathways and writes about what FDA reviewers look for in each. More from Christian.