FDA Cybersecurity Submission Requirements Checklist

By Christian Espinosa, MBA, CISSP

Founder & CEO · Blue Goat Cyber

Reviewed by Trevor Slattery

COO · Blue Goat Cyber

Last reviewed: May 1, 2026

Free Guide · Blue Goat Cyber · Updated 2026

CHECKLIST · 1 PAGE · PROSPECT RESOURCE

FDA Cyber Requirements: The Law, the Guidance, the eSTAR A diagnostic for Section 524B compliance and eSTAR readiness.

Use this checklist to determine whether your device meets the 'cyber device' definition under Section 524B of the FD&C Act and whether your eSTAR cybersecurity attachments will pass the Refusal-to-Accept gate.

Statutory applicability (Section 524B) Does the device include software validated, installed, or authorised by the sponsor?

Can the device connect to the internet?

Does it have any wireless interface (Bluetooth, Wi-Fi, NFC, cellular)?

Does it connect to external hardware, removable media, or USB?

Mandatory eSTAR cybersecurity content Software Bill of Materials in a machine-readable format (CycloneDX or SPDX). Threat model covering all system boundaries, trust zones, and assets. Cybersecurity risk assessment aligned with AAMI TIR57 (or equivalent). Security risk management plan and report integrated with the ISO 14971 file. Cybersecurity labelling content for the end user, per current FDA guidance.

Postmarket obligations Documented Coordinated Vulnerability Disclosure (CVD) plan. Process for identifying and addressing postmarket vulnerabilities. Verifiable schedule for releasing security patches and updates.

How to read it. Any 'Yes' in the statutory section means Section 524B applies. Any 'No' in the mandatory eSTAR section is a material RTA risk - FDA rejects submissions that omit these attachments before substantive review begins.

NEXT STEP → Book a 20-minute eSTAR gap analysis to map your current documentation against the mandatory Section 524B fields. Book your discovery call: go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session

Talk to us

This guide is part of Blue Goat Cyber's MedTech cybersecurity library. To apply it to your device program, book a 30-minute strategy session - no cost, no obligation. Or browse all guides.