Threat models, SBOMs, security testing, and cybersecurity documentation in one scope. Choose individual deliverables or the broader premarket package. Fixed fee after scoping. Your device, pathway, available evidence, and testing needs shape the timeline.
The short answer
The FDA Premarket Cybersecurity Package brings threat modeling, cybersecurity risk assessment, security architecture, SBOM work, security testing, labeling, and vulnerability management planning into one traceable evidence set. Choose individual deliverables or the broader package for your 510(k), De Novo, or PMA submission. We agree the scope, deliverables, fixed fee, and dates before work begins. Section 524B obligations remain distinct from guidance recommendations. IDE work is scoped to investigational use rather than treated as a Section 524B marketing submission.
275+ FDA submissions supported, zero cybersecurity rejections. Cybersecurity Work Owned In-House.
Trusted by leading MedTech companies
From a threat to submission evidence
Each security requirement connects to a threat, a control, and test evidence. Your regulatory team can follow that trail into the submission.
Fictional example. Not a client report or a prescribed FDA document format.
THREAT · TM-04
An attacker installs unauthorized firmware.
CONTROL · SEC-12
The device verifies the update signature before installation.
TEST · PT-08
A modified update is rejected; the authorized update installs.
EVIDENCE
Threat model → security requirement → test result → submission reference
Premarket package scope
Fixed fee, quoted after a scoping call. Scope depends on your device, pathway, and existing evidence. Your regulatory team submits, and the FDA makes the regulatory decision.
Drafts are fine and can mature during the engagement. We review your inputs at the start. Any missing input is listed in an input review memo with its effect on the schedule.
| What we need | What it's used for |
|---|---|
| Software architecture document and requirements | Threat model, architecture views, control coverage |
| Intended use, indications, and IFU or labeling drafts | Risk assessment, cybersecurity and interoperability labeling |
| ISO 14971 hazard analysis and severity scale | Risk assessment, risk management report, threat-to-hazard mapping |
| Source code, read-only access | Static code analysis (SAST) |
| Build and dependency manifests | SBOM and component support data |
| Device builds and platform requirements | Penetration testing and security context |
| Interface and data protocol details | Interoperability documentation |
| Changes since the last cleared version, if any | Baseline for modified-device submissions |
| Test rig access, test accounts, and site access if onsite | Onsite and remote testing |
| Vulnerability handling and software update processes | Cybersecurity Management Plan |
The roadmap
Scope · architecture · timeline
Fixed-fee quote in writing
Data flows · trust boundaries · attack paths
Threat model & risk assessment
Components · vulnerabilities · pen testing
SBOM & test report
Traceability · labeling · plans
Ready for the FDA
Your existing quality system
Connect device cybersecurity evidence to the way your team works. We help integrate product cybersecurity procedures, records, and responsibilities into your existing quality management system (QMS).
Device-specific cybersecurity documents and the handover explaining how to maintain them belong in the premarket package. Delivering those documents is not the same as revising your organization's quality procedures.
Procedure revisions, cross-team responsibilities, evidence connections, and implementation support are agreed within your premarket engagement. They are not automatically included in every package.
Deliverables are agreed after review: a gap assessment, procedure revisions, record templates, an evidence map, and a prioritized implementation plan. Scope and pricing depend on your existing procedures and the work required.
Your quality team retains ownership and approval of the QMS. Our scope is product cybersecurity, not full QMS implementation, QMS certification, or verification and validation (V&V).
See the worked example and request a quoteThe Feb 3, 2026 final premarket cybersecurity guidance and Section 524B(b) describe the content of your eSTAR cybersecurity attachments. Every artifact below is in scope when we run the full premarket engagement.
Layers shown outermost (top) to innermost (bottom). Dashed rows are part of the surrounding system but out of scope for this view.
Every fda premarket cybersecurity package engagement produces evidence aligned to the regulatory and consensus standards FDA reviewers and notified bodies expect to see, traceable, complete, and ready to drop into your ISO 13485 quality system.
Recommends risk-based cybersecurity evidence, including threat modeling, architecture views, and testing. An SPDF is encouraged, not mandatory; Section 524B separately establishes statutory duties for covered cyber devices.
Statutory duties for cyber devices on covered 510(k), De Novo, PMA, PDP, and HDE pathways: a postmarket vulnerability plan, cybersecurity and update processes, and an SBOM. IDE applications are not Section 524B submissions.
FDA's mandatory interactive submission template with structured upload slots for each cybersecurity artifact.
An end-to-end secure development approach encouraged in Section IV.A.1. Other approaches may satisfy the QMSR; Section 524B does not require a named SPDF.
The consensus standard for medical device security risk management, asset, threat, vulnerability, likelihood, severity, and residual risk acceptability.
Foundational risk management standard. Cybersecurity risk is tied directly to patient-safety risk in the 14971 file.
International QMS standard for medical devices. Cybersecurity deliverables are designed to slot into your existing 13485 QMS without parallel paperwork.
Recalls, CISA ICS-MA advisories, and disclosed research that shape what reviewers ask about, and what this engagement is built to cover.
Cyber devices submitted without the §524B(b) artifacts are subject to RTA. The February 3, 2026 guidance describes recommended cybersecurity documentation. Address applicable statutory obligations separately from guidance recommendations.
Review documentation for testing scope, device-specific threats, and software-component coverage. Trace the applicable evidence to reviewer questions rather than assuming a frequency ranking.
"Blue Goat Cyber helped us navigate our first end-to-end cybersecurity testing for our wearable medical device. Their communication was excellent, their timeline exceeded expectations, and their report helped us achieve FDA clearance without any additional questions. It was a truly seamless experience."
Cybersecurity content for Predetermined Change Control Plans, for AI/ML and non-AI devices.
View PCCP Cybersecurity ServicesCybersecurity evidence and technical responses for FDA correspondence.
View FDA Deficiency ResponseFull FDA premarket cybersecurity package for Software as a Medical Device - cloud, mobile, and web SaMD.
View SaMD CybersecuritySee how this service applies to your specific MedTech segment.
Our eighteen-item delivery map organizes the work; it is not a statutory list of eighteen required documents. Section 524B sets binding obligations for cyber devices on covered pathways. The February 3, 2026 guidance recommends the supporting evidence, tailored to device risk and applicability. MDS2 is an optional procurement disclosure, not an FDA or eSTAR requirement.
SBOM and component support analysis. Section 524B(b)(3) establishes the SBOM obligation for covered cyber devices; support details are guidance recommendations. Unknown supplier dates remain unknown.
Traceability flow: each step builds on the one before it
Risk management report, threat model, cybersecurity risk assessment, unresolved anomalies, and measures/metrics, the anchor artifacts every downstream deliverable traces back to.
Security requirements, security architecture views, and interoperability risk assessment, the design evidence reviewers grade for coverage.
Scoped SAST and penetration testing with a Test Plan, Test Cases, and Test Report. Human-reviewed findings, limitations, remediation, and retests document the security checks performed.
Cybersecurity and interoperability labeling, with optional MDS2 procurement disclosure where useful. MDS2 is not required by the FDA or eSTAR.
Vulnerability management planning, including CVD, monitoring, and update processes for applicable Section 524B obligations. Ongoing postmarket operations are separately scoped.
Blue Goat maps applicable deliverables to the relevant eSTAR fields. This eighteen-item delivery map is not an FDA acceptance checklist. MDS2 is an optional procurement disclosure, not an FDA or eSTAR requirement.
See our IEC 62304 deliverable map and manufacturer responsibilities for where cybersecurity evidence supports software lifecycle records. The manufacturer retains software classification, general software verification and validation, QMS approval, risk acceptance, and release decisions; the map does not establish IEC 62304 conformity.
Choose individual threat modeling, SBOM work, or security testing when your other documentation is in place. Choose the broader package when you need the agreed documentation and testing in one engagement. Fixed fee after scoping.
Medical Device Penetration TestingReview your device scope, evidence, testing, and submission handoff before the discovery call. No email required.
Your device, pathway, available evidence, and testing needs shape the plan. We agree the scope, deliverables, fixed fee, and dates before work begins.
Discuss your device, submission pathway, available evidence, and testing needs with a senior practitioner. These define the work and the timeline.
Choose individual deliverables or the broader premarket package. You receive the agreed scope, deliverables, dates, and fixed fee before work begins.
We build the agreed threat models, SBOMs, architecture documentation, and security testing evidence. Device access and manufacturer feedback shape delivery dates.
Your regulatory team receives the agreed cybersecurity documentation and testing evidence mapped to the applicable eSTAR fields. The manufacturer reviews and submits the evidence.
We focus this page on premarket because that's likely why you're here - but we support the whole journey, from early design through post-market monitoring.
Need design-stage help, deficiency response, or postmarket support? See all services or book a 30-min call.
The proposal records scope, assumptions, deliverables, dates, and support terms. The quote turnaround is not a promise of completion.
If the FDA raises a cybersecurity question, we answer it at no extra cost until the cybersecurity portion is closed. 275+ FDA submissions supported, zero cybersecurity rejections. Clearance is always the FDA's decision.
Elsewhere: Deficiency rework billed as a new project.
We scope it, we price it, we deliver it. No hourly billing that balloons. No change orders for 'unexpected complexity.'
Elsewhere: Hourly T&M with scope creep.
Cybersecurity isn't a one-shot deal. Retests are included in your fixed fee until every finding with uncontrolled risk is closed.
Elsewhere: Per-retest invoices.
Every engineer on your project is US-based and works exclusively for Blue Goat. No offshore handoffs, no shared resources.
Elsewhere: Offshore subcontractors and shared resources.
GoatWatch (our SBOM management platform) and our client collaboration portal are included, not upsold. Built for medical device teams.
Elsewhere: Tooling sold separately as add-ons.
We deliver agreed cybersecurity records and testing evidence mapped to applicable eSTAR fields and the FDA February 3, 2026 guidance. Your regulatory team reviews and submits them.
Elsewhere: Raw findings handed off to your RA team.
Cybersecurity risk is considered in patient-safety context. Manufacturer device evidence supports clinical severity and risk decisions.
Elsewhere: Cybersecurity as a side practice.
510(k), De Novo, or PMA: if the FDA raises a cybersecurity question, we answer it at no extra cost until the cybersecurity portion is closed, regardless of the pathway.
Elsewhere: Pathway-limited or 'best effort' commitments.
Shared identifiers connect threats, controls, findings, labeling, and patient-harm context. We record missing inputs and evidence limitations for manufacturer review.
Elsewhere: Disconnected artifacts your RA team has to stitch together.
We'll send a fixed-fee scope tailored to your submission within 24 hours.
See if we're a fitDevice risks, intended use, submission pathway, and available evidence shape documentation and testing. IDE work is investigational scope, not a Section 524B marketing submission. Confirm review deadlines with your regulatory team.
| Dimension | 510(k) | De Novo | PMA | IDE |
|---|---|---|---|---|
| Cyber artifacts required | Applicable cybersecurity evidence | Applicable cybersecurity evidence | Applicable cybersecurity evidence | Scaled to the trial |
| Documentation depth | Moderate. Predicate comparison anchors scope. | High. No predicate, so controls must be justified from first principles. | Highest. Full design-history-level traceability. | Focused on patient safety during the study. |
| Penetration testing expected | Yes, independent report with plan, cases, and findings. | Yes, plus rationale tying tests to novel risk. | Yes, often with re-test after design changes. | Yes for connected devices, narrower scope. |
| Threat model scrutiny | Trust boundaries and STRIDE coverage. | Same, plus special-controls justification. | Same, plus multi-patient harm and manufacturing scope. | Same, scoped to investigational use. |
| SBOM and support dates | Machine-readable, with end-of-support dates. | Same. | Same, plus change control across modules. | Same. |
| Review clock | 90 FDA days, 180-day deficiency response window. | 150 FDA days. | 180 FDA days, panel possible. | Confirm the applicable IDE review process with your regulatory team. |
| Postmarket plan weight | Required. | Required, ties into special controls. | Required, plus annual report updates. | Study-specific vulnerability handling; not a Section 524B marketing obligation. |
| Cybersecurity delivery dates | Agreed after scope and evidence review | Agreed after scope and evidence review | Agreed after scope and evidence review | Agreed for the investigational build and study |
Delivery dates are agreed after scope and evidence review, not assigned by pathway alone. Engineering fixes, retests, and manufacturer review affect completion. The FDA review process is separate.
A transparent, side-by-side look at outsourcing to us, building it in-house, or hiring a typical vendor.
Start date
Fee structure
Evidence delivery dates
Threat modeling, SBOM work, and security testing across the agreed device ecosystem.
| Capability | Blue Goat Cyber | In-House / DIY | Typical Vendor |
|---|---|---|---|
Exclusively testing medical devices since 2022 Refined, MedTech-specific process - not a generic pentest checklist retrofitted for healthcare. | |||
Medical protocol testing (DICOM, HL7/FHIR, MedRadio, BLE Medical) Specialized protocols with their own attack surface. Most vendors lack the tooling or expertise. | |||
Penetration testing (device + cloud/mobile) Most competitors test only the device, not the full ecosystem. | |||
Wireless / Bluetooth / RF security testing Critical for connected devices, often limited or scoped out. | |||
Threat modeling (STRIDE / attack trees) | |||
SBOM generation & management (GoatWatch) | |||
Postmarket vulnerability monitoring Continuous monitoring with our GoatWatch platform. | |||
IEC 62443 / IEC 81001-5-1 alignment |
Cybersecurity documentation and evidence for your regulatory team's submission.
| Capability | Blue Goat Cyber | In-House / DIY | Typical Vendor |
|---|---|---|---|
FDA premarket cybersecurity documentation Agreed evidence mapped to applicable eSTAR fields and Section 524B obligations. | |||
FDA 2026 Premarket Cybersecurity Guidance aligned SPDF, Section 524B, threat modeling, SBOM, security architecture views. Most are still catching up. | |||
AAMI SW96 (Medical Device Security Standard) The new consensus standard FDA increasingly references. | |||
Pre-Submission (Q-Sub) meeting support We help you prep cyber questions for FDA Q-Subs to de-risk the submission before it's filed. | |||
Dedicated FDA submission support We've never had an FDA cyber rejection. | |||
Deficiency letter & RTA response | |||
Postmarket vulnerability management support Continuous SBOM monitoring, vulnerability triage, and patch guidance after clearance. | |||
EU MDR / IVDR submissions MDCG 2019-16 alignment for EU market submissions. |
How we work, and why it removes risk for you.
| Capability | Blue Goat Cyber | In-House / DIY | Typical Vendor |
|---|---|---|---|
Cybersecurity deficiency responses covered If the FDA raises a cybersecurity question, we answer it at no extra cost until the cybersecurity portion is closed. | |||
Retests included Retests until every finding with uncontrolled risk is closed, with no per-retest invoices. | |||
275+ FDA submissions supported, zero cybersecurity rejections Track record across startups to Intuitive Surgical, bioMérieux, Inogen, Natera. | |||
Senior expert leads your engagement | |||
Service-Disabled Veteran-Owned (SDVOSB) Federally certified, advantageous for federal MedTech contracts. | |||
Fixed fee pricing | |||
Start date agreed in the proposal Start dates depend on scope, device readiness, and team availability. |
30-minute call · scoped quote within 24 hours.
"Blue Goat's niche expertise in FDA-facing cybersecurity made all the difference. Their reports were built with the FDA's expectations in mind, which gave us confidence that we were submitting exactly what reviewers want to see."
"Blue Goat helped us navigate our first end-to-end cybersecurity testing for our wearable medical device. Their communication was excellent, their timeline exceeded expectations, and their report helped us achieve FDA clearance without any additional questions."
"Blue Goat Cyber takes the burden off our engineers and makes FDA cybersecurity requirements easy to understand. The organized documentation, perfectly formatted for eSTAR, saves us countless hours."
"Blue Goat's knowledge of regulatory requirements versus cybersecurity challenges was highly valuable. Their team and competencies nicely filled our resource needs as a startup."
Our team holds the offensive security certifications real attackers respect, backed by hands-on U.S. government red team and military cyber operations experience.
Certified Information Systems Security Professional
Certified Secure Software Lifecycle Professional
Offensive Security Web Expert
Offensive Security Certified Professional
Certified Red Team Expert
Certified Red Team Lead
Certified Azure Red Team Professional
Certified Bug Bounty Hunter
Our work has been honored by the leading voices in medical device cybersecurity.
Medical Tech Outlook - cover story profiling Blue Goat Cyber as a top industry leader.
MedTech World Malta - sponsored by the Malta Medicines Authority.
MedTech World North America 2026 Awards (in collaboration with CS Lifesciences) - recognition of our patient-safety-first approach to FDA cybersecurity submissions and global medical device security partnerships.
Same logic our reviewers apply on day one of an engagement. No signup, results are yours to keep.
Bring your device, submission pathway, and available evidence. Discuss individual deliverables or the broader FDA Premarket Cybersecurity Package. Fixed fee after scoping.
With a senior medical device cyber expert, not a sales rep.
Specific to your 510(k), PMA, De Novo, or premarket submission.
No surprises. No hourly billing. No obligation.
Optional. We can sign your NDA before the first meeting.
If the FDA raises a cybersecurity question, we answer it at no extra cost until the cybersecurity portion is closed.
Prefer to talk now? Call (844) 939-4628. Reschedule or cancel anytime.
Straight answers from the team that will actually do the work.
