eSTAR 7.1 Submission and Cybersecurity Checklist (2026)

This checklist covers the whole eSTAR, not only cybersecurity. Use it as a working list for a 510(k), De Novo, or PMA built on the non-In Vitro Diagnostic (nIVD) or In Vitro Diagnostic (IVD) eSTAR 7.1 template. For the cybersecurity section in detail, see the eSTAR cybersecurity attachment guide and the 18 deliverables map. Still at the prototype stage? Start with the early-stage cybersecurity readiness checklist.

Why this matters

eSTAR is required for 510(k) submissions (since October 1, 2023) and for most De Novo requests (since October 1, 2025). The form checks itself for completeness, so a missing answer or attachment shows up as an incomplete flag rather than a surprise during review. Still, a complete form is not the same as a strong submission. Most deficiencies trace back to thin evidence behind a filled-in field, and cybersecurity is one of the most common areas where that happens.

Phase 1: Confirm the pathway and get the template

• Confirm the submission type: Traditional, Special, or Abbreviated 510(k); De Novo; or PMA (original or supplement).
• Confirm the device classification, product code, and regulation number.
• Decide whether a Pre-Submission (Q-Sub) is worth doing first. If so, use the Early Submission Requests eSTAR (PreSTAR) version 3.1.
• Download the current eSTAR 7.1 template (nIVD or IVD) from the FDA eSTAR program page. Right-click and save the link; do not fill it in a browser.
• Open it in Adobe Acrobat Pro (recommended), PDF-XChange Editor 10.2 or higher, or Foxit PDF Reader 12.1 or higher.
• If you are moving work from a 7.0 file, use the template's import feature, then recheck the fields 7.1 changed (see What changed in eSTAR 7.1).
• Decide whether the eSTAR will also go to Health Canada, and set the jurisdiction accordingly.

Phase 2: Gather the supporting documents

• Applicant and correspondent details, including the establishment registration number if you have one.
• Records of any earlier FDA interactions (Pre-Sub feedback, prior submission numbers).
• Device description: principle of operation, components, accessories, materials, software, and images or drawings.
• Indications for Use statement.
• For a 510(k): predicate device(s) and the substantial equivalence comparison. For a De Novo: the classification rationale and proposed special controls. For a PMA: manufacturing and quality system information.
• List of consensus standards used, with recognition numbers and any deviations.
• Labeling: device labels, instructions for use, and patient labeling.
• Sterilization, reprocessing, and shelf-life evidence, if applicable.
• Biocompatibility evaluation, if the device contacts the patient.
• Software documentation at the right documentation level.
• Cybersecurity documentation for a cyber device under Section 524B, including the SBOM and the cybersecurity management plan. See the submission-ready cybersecurity checklist.
• EMC, wireless, and electrical safety test reports.
• Performance testing: bench, animal, and clinical evidence as needed, including human factors where it applies.
• Administrative statements: Truthful and Accurate statement, 510(k) Summary or Statement, and certifications as required.

Phase 3: Complete the eSTAR sections

Work top to bottom. The form reveals and hides questions based on earlier answers, so answer in order.

• Submission type and application details.
• Cover letter and applicant and correspondent information. In 7.1 the address fields include a US state dropdown and extra checks.
• Pre-submission correspondence and previous submissions.
• Consensus standards.
• Device description.
• Indications for Use. The optional Intended Population question added in 6.1 is gone in 7.1.
• Classification and, for a 510(k), predicates and substantial equivalence.
• Design Control Activities, for a Special 510(k). 7.1 adds a note on handling Human Factors here.
• Labeling.
• Reprocessing, sterility, and shelf life.
• Biocompatibility.
• Software and cybersecurity.
• EMC, wireless, and electrical safety. In 7.1, EMC information covers the whole system, not only the device, and RTCA DO-160 specifications may be marked N/A.
• Performance testing, including Clinical Evidence, Real-World Data, and Human Factors subsections where they apply.
• References and administrative documentation.

Phase 4: Attach, cross-check, and lock the file

• Attach each document in the field it belongs to, not as a general attachment.
• Use clear file names and page references so a reviewer can find each claim.
• Check that device names, model numbers, and software versions match across every attachment.
• Check that standards cited in test reports appear in the Consensus Standards section.
• Clear every "Required Question Incomplete" flag; the form shows them on each section.
• Have someone outside the authoring team do a final read.
• Save a final copy with a new file name and keep it unchanged as your record.

Phase 5: Pay the user fee

• If you qualify, request a Small Business Determination well ahead of time; it lowers the fee.
• Pay the fee through the FDA's Device Facility User Fee (DFUF) system.
• Enter the Payment Identification Number in the eSTAR.

Phase 6: Send to the FDA and track the review

• Send CDRH submissions through the CDRH Portal. CBER-regulated devices follow the CBER route listed on the eSTAR program page.
• Keep the acknowledgment. Once received, the submission stays on that eSTAR version, so later responses use the same version.
• For a 510(k), expect technical screening first; the FDA may put the submission on hold if something is missing.
• Track the FDA review clock. For a standard 510(k) the goal is a decision within 90 FDA review days, which pauses while you answer questions.
• Respond to any Additional Information request inside the response window.

What changed in eSTAR 7.1

eSTAR 7.1 is a minor update. According to the version history inside the template, it adds extra checks and a US state dropdown to the administrative data, removes the optional Intended Population question from Indications for Use, adds a note on Human Factors in Special 510(k)s, fixes a Human Factors display problem in pre-2018 Adobe Acrobat, and makes small EMC changes. It does not change the cybersecurity section. The FDA says minor updates typically do not lead to additional information requests, so a submission started in 7.0 does not need to be redone.

How Blue Goat Cyber approaches this

We prepare the cybersecurity portion of the eSTAR: the threat model, security risk assessment, SBOM, penetration testing, and management plan, each mapped to the field it belongs in. Our FDA Premarket Cybersecurity Services engagement covers the full set, and our penetration testing includes unlimited retests. Your regulatory team or consultant owns the other eSTAR sections.

FAQ

Is eSTAR 7.1 required?

eSTAR itself is required for 510(k)s and most De Novos. Version 7.1 is the current template, but it is a minor update, and the FDA says using the previous minor version typically does not trigger extra information requests.

When was eSTAR 7.1 released?

September 21, 2026, according to the version history inside the template.

Can I fill eSTAR in Adobe Acrobat Reader?

Reader opens the form, but you cannot save changes or add attachments. Use Adobe Acrobat Pro, PDF-XChange Editor 10.2 or higher, or Foxit PDF Reader 12.1 or higher.

Did eSTAR 7.1 change the cybersecurity section?

No. The cybersecurity fields are the same as in 7.0.

How do I send an eSTAR to the FDA?

Send CDRH submissions through the CDRH Portal after paying the user fee and entering the Payment Identification Number in the form.

Talk to a regulatory cybersecurity team

If your eSTAR is close to ready and the cybersecurity section is the open item, book a discovery session and we will walk through your evidence with you.