What is the typical response timeline?

There is no universal delivery time. Agree a schedule based on engineering changes, device access, retesting, and existing evidence. Do not plan around an unverified case-study turnaround.

What if we have under 30 days of clock left?

Escalate immediately and agree what can be completed before the deadline. An incomplete interim response or a clarification meeting does not automatically stop or extend it. Confirm the response strategy with the FDA.

How is the gap analysis scoped?

Agree the analysis scope, fee, required inputs, and delivery date before work starts. Initial 24-hour quote and triage support is not a promise to finish analysis or remediation within that period.

Can you take over a response another vendor started?

Yes. We do mid-engagement transitions when an existing vendor is not delivering. The first deliverable is a gap analysis of what they have produced vs what the reviewer asked for, then we bridge the gap. Honest assessment up front - sometimes finishing what they started is faster than rebuilding.

Do you file the response or do we?

Either. Most clients prefer that we deliver the complete reviewer-ready package and their internal RA team handles the actual eSTAR upload. We can also coordinate directly with your filing consultant. Deliverable format is the same.

How is De Novo deficiency response different from 510(k)?

510(k) responses lean on the predicate-comparison narrative; De Novo responses lean on security-architecture justification because there is no predicate. PMA responses involve cross-discipline coordination. IDE responses focus on study-subject safety arguments.

What happens if the reviewer rejects the second-cycle response?

For a 510(k) AI request, a complete response is due within 180 calendar days of the request. Do not assume later requests share one continuing clock; follow the specific FDA letter and confirm the applicable deadline.

Will retesting be required?

For most pen-test deficiencies, yes - either to extend scope or to validate fixes. We scope retesting tightly to the deficiency, not the whole engagement, so cost and time are bounded.

How do you avoid creating new deficiencies in the response?

Every artifact change is run through the eight-artifact consistency check (see our premarket checklist). New trust boundaries in the threat model are reflected in the architecture views; new SBOM entries get vulnerability triage; new pen test scope is reflected in the Test Plan, Test Cases, and Test Report.

What is the single fastest way to slow down a response?

Argue with the reviewer. The response document should address the deficiency directly with new evidence; framing-disputes about whether the deficiency was reasonable extend the cycle every time. Save those for the post-clearance lessons-learned.

FDA Cybersecurity Deficiency Response Timeline (2026)

Direct Answer

How long do you have to respond to an FDA cybersecurity deficiency letter?

Identify the letter type and deadline, then sort each item into an evidence update, new testing, or an engineering change. A 510(k) Additional Information request allows 180 calendar days for a complete response; do not apply that deadline to every letter. Delivery time depends on device access, remediation, evidence quality, and retesting.

Talk to a MedTech cybersecurity expert

How the response clock works for each pathway

The FDA review stops when the letter is issued and restarts when a complete response arrives. The clock starts on the issue date, not the day your team reads the letter. Log that date as soon as the letter arrives.

Pathway	FDA review goal (MDUFA)	Response window	If you miss it
510(k)	90 FDA days	180 calendar days	Considered withdrawn
De Novo	150 FDA days	180 calendar days	Considered withdrawn
PMA	180 FDA days	180 days plus one automatic 180-day extension	Considered voluntarily withdrawn after 360 days

The PMA extension comes from the FDA's PMA review-clock guidance. For 510(k) and De Novo, do not plan on an extension. If no complete response arrives in time, you may need to resubmit.

Key requirement

The response must address every deficiency in the letter. The FDA reviews the response as a whole, and unresolved items can trigger another request or a negative decision.

Before a formal letter, some reviewers use interactive review to ask quick questions by email. Those answers are usually due within a short window set by the reviewer. Treat them as urgent, because a good answer can keep an issue out of the formal letter.

The first 24 hours

When the letter arrives, confirm the deadline stated by the FDA. Initial triage should establish:

Which deficiency items need full artifact rebuilds (e.g., new pen test) and which need updates (e.g., add a missing architecture view).
Which items have data dependencies (need engineering work) vs documentation dependencies (need writing).
Whether retesting is required and on what scope.
A realistic timeline with milestone gates.

Triage: sort items by duration, not by order in the letter

Reviewers reference specific guidance sections. Map each deficiency item to the section it cites and the artifact it implicates. Group items into categories:

Artifact missing entirely (rebuild from scratch).
Artifact present but inadequate scope (extend or rerun).
Artifact present but inconsistent with another artifact (reconcile).
Documentation gap (write the missing narrative).
Traceability gap (build the missing matrix entries).

How long each fix takes, and in what order

1. Thin threat model

Examples include missing trust boundaries, unsupported risk arguments, and inconsistent architecture views. Trace threats to controls and tests. STRIDE is one possible method, not a mandated format. Schedule depends on architecture complexity and available evidence.

2. Incomplete pen test

If testing omitted relevant interfaces or lacks evidence, scope the missing surface and update methods, tested builds, findings, and retest results. A particular attestation letter is not a universal FDA requirement. Retesting follows the change and manufacturer-owned risk assessment.

3. Weak postmarket plan

Update monitoring sources, responsibilities, risk-based remediation decisions, disclosure intake, and support tracking. Timing depends on existing procedures and manufacturer approvals.

The reviewer-ready response format

A useful response structure is:

Cover letter - identifies the submission, the deficiency letter date, and the response date.
Point-by-point response document - each deficiency item quoted verbatim, response narrative, references to updated/new artifacts.
Traceability matrix - deficiency item → response → artifact location.
Updated artifacts - rebuilt or extended threat model, pen test report, SBOM, postmarket plan, etc.
Testing evidence - updated methods, tested configuration, findings, and retest results where relevant.
Reviewer-eye narrative - one-page summary the reviewer can read first to orient.

Pathway-specific considerations

510(k) AI letter

Focused on substantial-equivalence-relevant cyber items - threat model alignment to predicate, SBOM completeness, pen test scope. Predicate-comparison narrative is often the missing piece.

De Novo deficiencies

Often probe novel risk arguments and security-architecture justifications. Response needs to strengthen the architecture rationale, not just add documents.

PMA deficiencies

Deepest documentation, full design history file traceability, and frequently coordinate with non-cyber reviewers on risk control and human factors. Response should explicitly address cross-discipline integration.

IDE Clinical Hold (21 CFR §812.42)

Focus on whether unresolved cybersecurity risks could expose study subjects to unreasonable risk. Response demonstrates threat model coverage of the clinical environment, security risk assessment, and any compensating controls before enrollment proceeds.

How fixed-fee response works

Agree scope after reviewing the letter, original evidence, device access, and remediation dependencies. The package may include revised artifacts, retesting, point-by-point responses, and traceability. If the FDA raises a cybersecurity question, we answer it at no extra cost until the cybersecurity portion is closed. The manufacturer approves risk decisions and the submission; the FDA decides the outcome.

Frequently asked questions

Anatomy of a response that closes the item

Reviewers assess responses against the specific question they asked, not against the general quality of your submission. A response closes when the reviewer can, without hunting, see three things: the direct answer, the changed artifact, and where the change lives.

Structure each item the same way:

Restate the deficiency verbatim. Do not paraphrase. Paraphrasing is how a response ends up answering a slightly different question than the one asked.
Answer in the first two sentences. Lead with the conclusion, not the background. "The threat model has been revised to enumerate threats for all four external interfaces, including the previously omitted USB service port" is a better opening than three paragraphs of methodology.
Name the changed artifact and version. "Threat Model, rev C, Section 4.2, Table 7, rows 41 to 58."
Attach the revised artifact in full, not an excerpt, and keep revision history visible.
State what did not change and why, when the reviewer's premise is partly incorrect. Disagreement is acceptable when it is evidenced; silence is not.

When the reviewer's premise is wrong

Occasionally a deficiency rests on a misreading, usually because the information existed but was in an unexpected place. Push back, carefully. Acknowledge the reviewer's concern, point to exactly where the information was located in the original submission, and then make it easier to find anyway by adding a cross-reference or moving the content to the expected attachment.

What does not work is a response that says the information was already provided and stops there. Even when true, it invites a second cycle. Fixing the discoverability problem alongside the factual correction closes the item.

When to talk to the FDA reviewer

Talk to the reviewer early, once you have a draft plan for each deficiency. The FDA allows sponsors to request a call or meeting to clarify an Additional Information request.

A short call can confirm whether your proposed evidence will be enough, especially for disputed findings or where you plan to justify residual risk instead of changing the design. Come prepared with a one-page summary of each deficiency and your planned response. Do not use the call to argue; use it to confirm.

Managing the clock

Planning guidance, not measured results. The timings in this section (first two days, first week, days versus weeks, final quarter of the window) are rules of thumb for sequencing work. They are not averages from Blue Goat engagements or promises about your response.

Interactive review questions typically carry short response windows, and a full deficiency letter puts the submission on hold until you respond. The failure pattern is spending three of your available weeks re-testing and one week writing, then discovering that the new test results contradict an unchanged artifact elsewhere in the package.

Work in the opposite order. Draft the response structure in the first two days, which surfaces every artifact that must change. Run remediation and testing against that list. Reserve the final quarter of the window for a consistency pass across all changed and unchanged documents, because a response that introduces a new inconsistency generates the next letter.

Where to go next

A deficiency letter creates both a scheduling and an evidence problem. Confirm the applicable deadline, clarify ambiguous questions, and identify engineering dependencies before committing to a schedule.

Do the interpretation pass in the first week, with the whole team in one room. Read each item twice: once for the literal words, once for the concern behind them. "Provide additional detail on the threat model" is rarely a request for more pages. It usually means a trust boundary was analyzed incompletely, or threats were listed without linking to clinical harm, or the model did not cover the mobile app and cloud backend. Write down your reading of the underlying concern next to each item, and if two people on your team read it differently, that item goes on the Q-Sub or clarification call list rather than into the response draft.

Second, triage by remediation cost, not by item order. Items that need only better documentation of work you already did can often be closed quickly (planning estimate). Items that need new testing need a lab booking now, because turnaround plus retest plus report writing usually takes weeks (planning estimate). Items that need a design change need an immediate decision on whether you change the design or argue the risk is acceptable, and that decision cannot wait until month four.

Third, write each response so it stands alone. State the concern as you understand it, state what you did, point to the specific attachment and page, and state the residual risk. Reviewers read your response next to the original item, not next to your whole submission. A response that requires them to reconstruct context earns a second letter.

Fourth, check consistency across items before you file. Deficiency responses are written by different people under time pressure, and the fastest way to earn a follow-up is to give two answers that cite different threat model versions or different tested builds.

If the letter arrived this week, book the interpretation session and the test lab in that order, today.

FDA Cybersecurity Deficiency Response Service - reviewer-intent analysis, remediation, retesting, and a consistent response package inside the 180-day window.
Premarket FDA Cybersecurity Submission Checklist - the completeness standard your reissued package should meet before it goes back.
How to Prepare 510(k) Cybersecurity Documentation Before You Submit - what to do differently on the next program so there is no second letter.
FDA Deficiency Letter Triage - classify each deficiency and plan the response order.
SIR Response Builder - draft a structured response to a Submission Issue Request.

FDA Cybersecurity Deficiency Response Timeline and Sequencing

Key Takeaways