How do 510(k) and PMA cybersecurity requirements differ?

Both pathways trigger Section 524B and require the full SPDF, SBOM, threat model, and pen-test package. PMA submissions add formal verification of security controls, deeper threat-modeling for life-sustaining functions, hardware-level security testing for implantables, and tighter integration with the ISO 14971 risk file and PMA annual reporting.

Is an SBOM required for both 510(k) and PMA?

Yes. Section 524B mandates an SBOM for any device meeting the cyber-device definition, regardless of submission pathway.

Does PMA require a separate cybersecurity submission?

No - cybersecurity content is integrated into the PMA modules. The 2026 guidance maps the same seven content areas as the 510(k) cybersecurity section, but with deeper expectations for verification and risk integration.

Can a 510(k) device skip pen testing?

No. Independent third-party penetration testing of all external interfaces is expected for any cyber device under the 2026 guidance, regardless of pathway.

Comparison guide

510(k) vs PMA: Cybersecurity Requirements

How the FDA's cybersecurity expectations differ between 510(k) and PMA submissions in 2026.

The details

Side-by-side breakdown

Dimension	510(k)	PMA
Device class	Class II (most)	Class III
Statutory basis	FD&C Act §510(k)	FD&C Act §515
Cyber-device threshold	Section 524B applies when the device has software + internet connectivity + exploitable characteristics.	Section 524B applies; almost every PMA device meets the definition.
SPDF documentation	Full SPDF (design controls, security risk management, SBOM, threat model, testing) submitted with the cybersecurity section.	All 510(k) content plus formal verification of security controls and tighter linkage to ISO 14971 risk file.
Threat-model depth	STRIDE-style enumeration with risk register entries per threat.	STRIDE plus attack-tree or kill-chain analysis for life-sustaining functions; explicit safety-vs-security coupling.
Penetration testing	Independent third-party pen test of all external interfaces; report included in submission.	Same as 510(k) plus hardware-level testing (side-channel, fault injection) for implantables.
Postmarket plan	Required: monitoring, CVD, patch cadence, EOL strategy.	Required and tied to PMA annual reporting; postmarket cyber events feed FDA's PMA supplement triggers.
Submission format	eSTAR (mandatory since Oct 2023).	Free-form modules; eSTAR pilot only.
Typical review clock	90 FDA days (often 6-9 months with cyber back-and-forth).	180 FDA days (often 12-18+ months).

Guidance

When to use which

Build your security risk-management file once, against AAMI SW96. A 510(k) cybersecurity package is a strict subset of what a PMA reviewer expects, so designing for PMA from day one means a 510(k) follow-on or predicate spinoff costs almost nothing.

For PMA submissions on implantables or life-sustaining devices, plan hardware-level security testing (side-channel, fault injection, firmware extraction) early - it is a long-lead activity that frequently extends the cybersecurity timeline by 8-12 weeks.

FAQ

Frequently asked questions

Keep exploring

Ready when you are

Get FDA cleared without the cybersecurity headaches.

30-minute strategy session. No cost, no commitment - just answers from people who've shipped 275+ devices supported.

Book strategy session Explore services