On this page
Published: · Updated:
Key Takeaways
- Combination products (drug + device, biologic + device) are cyber devices under Section 524B when all three Section 524B(c) elements are met in a covered submission.
- The lead center (CDER, CBER, or CDRH) is determined by primary mode of action, and cybersecurity expectations should be confirmed for the applicable submission pathway.
- Cybersecurity documentation must cover the device constituent's SPDF, SBOM, threat model, and postmarket plan, not just the drug-delivery mechanism.
- Harm analysis has to include dose-integrity impacts (over/under delivery from a cyber event), which most vendor templates miss.
- Coordinate premarket cybersecurity evidence with the constituent-part filings so the reviewer can trace one traceability matrix across the whole product.
What cybersecurity does the FDA expect for combination products?
A combination product device constituent meets Section 524B(c) only if it includes software validated, installed, or authorized by the sponsor, has the ability to connect to the internet, and contains technological characteristics validated, installed, or authorized by the sponsor that could be vulnerable to cybersecurity threats. Section 524B applies to covered 510(k), PMA, PDP, De Novo, and HDE submissions, not universally to NDA/BLA filings. Confirm cybersecurity documentation expectations with the lead center.
Drug-device combination products need a pathway-specific cybersecurity assessment, not an assumption that any electronic interface triggers Section 524B.
Last reviewed: June 2026 against the FDA "Cybersecurity in Medical Devices" final guidance (Feb 3, 2026), FD&C Act Section 524B, 21 CFR Part 3 (combination products), and the Office of Combination Products (OCP) jurisdictional framework.
At a glance
A combination product combines regulated constituents, such as a drug and a device. The FDA assigns a lead center based on primary mode of action. Section 524B covers cyber devices in 510(k), PMA, PDP, De Novo, and HDE submissions. Its definition requires that the device includes software validated, installed, or authorized by the sponsor, has the ability to connect to the internet, and contains technological characteristics validated, installed, or authorized by the sponsor that could be vulnerable to cybersecurity threats. USB or Bluetooth alone does not establish internet-connect ability. For NDA/BLA filings, confirm applicable device-constituent documentation with the lead center rather than asserting universal Section 524B coverage.
What counts as a combination product (and what doesn't)
21 CFR §3.2(e) defines four classes:
| Type | Example |
|---|---|
| 3.2(e)(1) Single-entity | Prefilled syringe; transdermal patch; drug-eluting stent |
| 3.2(e)(2) Co-packaged | Kit with vial + injector in one box |
| 3.2(e)(3) Cross-labeled drug + device | Drug whose labeling specifies a particular device (e.g. specific inhaler) |
| 3.2(e)(4) Cross-labeled investigational | Same as (3) but in trials |
The cybersecurity question turns on one thing: does the device constituent meet all three Section 524B(c) elements, and is the submission covered?
- Yes - connected auto-injector with BLE pairing to a phone app; on-body infusor with cellular telemetry; smart inhaler logging actuations to the cloud; digital pill with ingestible sensor; drug-pump platform with Wi-Fi: assess all three statutory elements and the submission pathway before concluding that §524B applies.
- No - purely mechanical autoinjector with no electronics; standard prefilled syringe; passive transdermal patch: §524B does not apply. Traditional 21 CFR 820/QSR-equivalent device controls only.
The fastest way to get this wrong is to assume "the drug is the point, the injector is just a delivery mechanism." If the injector phones home, it is a cyber device.
How lead-center designation actually works
The Office of Combination Products (OCP) assigns the lead center via a Request for Designation (RFD) or pre-RFD. PMOA controls. A drug-led product reviews under CDER's BLA/NDA pathway; a device-led product reviews under CDRH's 510(k)/De Novo/PMA pathway. Either way, the non-lead center is consulted.
Where sponsors get burned:
- CDER-led, software-rich device - CDER reviewers do not own cybersecurity expertise the way CDRH does. They consult CDRH, which means cyber comments often arrive late in review, compress timelines, and surface deficiencies that should have been caught at the threat-modeling phase a year earlier.
- Late-binding device decisions - the drug program defines the device constituent late in development. Cybersecurity scope (SBOM, secure boot, key management) cannot be designed in retroactively. Doing so adds 6-12 months.
- Platform reuse - sponsors reuse a device platform across multiple drug indications and assume the original cyber package carries forward. It does, but only if the threat model, SBOM, and CVD program are kept current. A 2-year-old SBOM with unpatched criticals is a deficiency every time.
What the cyber package looks like for a combination product
Scope the content to the device constituent, its risks, and the submission pathway. The deliverables map straight to the FDA premarket cybersecurity deliverables and eSTAR v7.1 map:
[RECOMMENDED DOCUMENTATION] In addition to applicable statutory items, the guidance recommends risk-appropriate evidence for the device constituent:
- Security Risk Management Report aligned to AAMI TIR57 / ANSI/AAMI SW96 and converged with the safety RMF per ISO 14971 vs AAMI TIR57.
- SBOM in SPDX or CycloneDX (machine-readable), with a known-vulnerability assessment; VEX statements are optional.
- Threat model (STRIDE or equivalent) tied to patient harm.
- Architecture views - global system, multi-patient harm, updateability, security use case.
- Cybersecurity testing - vulnerability scanning, penetration testing, software composition analysis, fuzz testing of communication interfaces.
- Postmarket plan - monitoring, CVD intake, patch cadence, end-of-life.
- Cybersecurity Management Plan under §524B(b)(1).
In a BLA/NDA, confirm placement with the lead center, such as regional information or a dedicated cybersecurity section and cross-references from the device description module. In a 510(k)/De Novo/PMA, it lives in the standard eSTAR cybersecurity attachments.
The CDER-led trap: budget cyber early
If a drug program lead is reading this, the single most consequential decision is when to engage cybersecurity expertise. The right answer is at the same point you lock the device constituent's bill of materials - typically during late-stage formulation work. Engaging at the BLA prep stage is too late: threat model, SBOM, and any required cryptographic key management need to influence device firmware before design freeze.
Sponsors who learn this the hard way share three regrets:
- Treating the connected device as a marketing feature (real-time adherence dashboards!) without scoping cyber budget for it.
- Outsourcing the device constituent to a contract manufacturer (CDMO/CMO) without contractually obligating SBOM delivery, secure SDLC evidence, and ongoing vulnerability monitoring.
- Pairing with a third-party companion app and assuming the app vendor owns app-side cybersecurity. The submission holder owns it. Period.
How Blue Goat approaches combination product cybersecurity
We start where most sponsors don't: at the device-constituent design freeze, not at submission prep. Our team's prior work on connected drug-delivery systems, on-body infusors, and smart inhalers means we walk in knowing the typical attack surface (BLE pairing flaws, OTA update key management, app-to-device authentication, telemetry endpoint exposure) and the deficiency patterns that follow.
We deliver the full premarket package - SBOM, threat model, security risk management report, architecture views, testing - in a form that drops into either a CDER Module 3 or a CDRH eSTAR. If the FDA raises a cybersecurity question, we answer it at no extra cost until the cybersecurity portion is closed. Start with our FDA premarket cybersecurity services page or our secure MedTech product design consulting if you are pre-design-freeze.
FAQ
Get a combination product cyber scope
If you are pre-submission on a connected drug-delivery product, get a scoped cybersecurity plan before the device design freezes. We will tell you what §524B requires, what your reviewers will ask for, and what your CDMO needs to deliver - in writing, in one call.
Book a combination product cyber scope
Reviewed by the Blue Goat Cyber medical device team. Christian Espinosa leads our combination-product engagements; the team's prior work spans connected auto-injectors, on-body delivery, and smart inhalers.
References
Primary sources cited or relied on in this guide:
- Combination Products (FDA), U.S. FDA
- Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (Feb 2026 final), U.S. FDA
- Section 524B of the FD&C Act (Consolidated Appropriations Act, 2023, §3305), U.S. Congress
- ANSI/AAMI SW96:2023, Standard for Medical Device Security, AAMI/ANSI
- IMDRF Principles and Practices for Medical Device Cybersecurity, IMDRF
Sources & references
Primary sources cited in this article. Links open in a new tab.
- Combination Products (FDA)- U.S. FDA
- Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (Feb 2026 final)- U.S. FDA
- ANSI/AAMI SW96:2023, Standard for Medical Device Security- AAMI
- IMDRF Principles and Practices for Medical Device Cybersecurity- IMDRF
