Does Section 524B apply to Class I devices?

Yes, if the device meets the cyber device definition. Class does not decide it.

Is the FDA guidance mandatory?

The guidance is not binding, but the statute is. Reviewers use the guidance to judge whether you met the statute, so following it is the practical path.

Do I need a penetration test for a 510(k)?

The FDA expects security testing that includes penetration testing for cyber devices. See pen test scope for a 510(k).

Can I do this in house?

Yes, if your team has medical device security experience. Many teams do part of the work themselves and buy a gap assessment or independent testing.

What if my device is already on the market?

Section 524B applies to new submissions, including changes that need one. Postmarket duties still apply. See our postmarket readiness plan.

FDA Cybersecurity Requirements

Direct Answer

What do medical device manufacturers need to buy to meet FDA cybersecurity requirements?

If your device includes software, can connect to the internet, and could be vulnerable to attack, Section 524B of the FD&C Act requires your premarket submission to include a postmarket vulnerability plan, evidence of a Secure Product Development Framework (SPDF), and a machine-readable software bill of materials (SBOM). To meet that, most manufacturers buy a threat model, a security risk assessment, architecture views, an SBOM, penetration testing, and postmarket and labeling documents, either as one package or piece by piece.

This guide is for the people who sign the purchase order: regulatory leads, engineering managers, quality heads, and founders. It explains what the FDA expects in plain terms, what you actually need to buy, what it tends to cost, and how to compare partners. For the full technical detail, read our Section 524B explainer and our summary of the FDA cybersecurity guidance.

Why this matters

Cybersecurity is now one of the areas where FDA reviewers most often ask manufacturers for more information. Since March 29, 2023, the FDA has been able to refuse to accept a cyber device submission that does not meet Section 524B. A missing or weak cybersecurity section can mean a refuse-to-accept decision, a hold letter, and weeks or months of rework. Buying the right work at the right time is usually cheaper than buying it twice.

Step 1: Find out whether your device is a "cyber device"

Section 524B(c) defines a cyber device as one that:

Includes software validated, installed, or authorized by the sponsor as a device or in a device,
Has the ability to connect to the internet, and
Contains technological characteristics that could be vulnerable to cybersecurity threats.

The FDA reads "ability to connect" broadly. Bluetooth, USB, Wi-Fi, and cellular links can all count, even if the device connects to the internet only through a phone or hub. Device class does not matter. If you are unsure, read our guide on the cyber device definition and pathway differences or ask on a free discovery call.

Step 2: Know what the law and the guidance ask for

The statute itself is short. It requires:

Section 524B requirement	What it means in practice
(b)(1) Postmarket vulnerability plan	A plan to monitor, identify, and address vulnerabilities after release, including coordinated vulnerability disclosure
(b)(2) Secure development and updates	Processes that give reasonable assurance the device and related systems are cybersecure, plus a way to ship updates and patches
(b)(3) SBOM	A list of commercial, open-source, and off-the-shelf software components
(b)(4) Other requirements	Anything the FDA adds by regulation (none issued as of this writing)

The February 3, 2026 premarket cybersecurity guidance explains what reviewers expect to see as proof. Guidance is not binding law, but reviewers use it as the working standard. For postmarket duties, the FDA's December 2016 postmarket guidance still applies.

Step 3: Know the documents you are buying

These are the deliverables reviewers look for in a typical premarket cybersecurity section. Our deliverables map shows where each one goes in eSTAR.

Threat model. Shows how an attacker could reach the device, app, and cloud, and what could go wrong. See our STRIDE threat modeling guide.
Security risk assessment. Rates each threat and links it to patient harm and the controls that reduce it, kept separate from your ISO 14971 safety risk file but tied to it.
Security architecture views. Diagrams of the global system, multi-patient harm, updates, and security use cases. See architecture views.
SBOM with support status. Every component, its version, its support level, and its end-of-support date, plus an assessment of known vulnerabilities. See SBOM for medical devices.
Security testing and penetration testing. Evidence that controls work and that an independent tester tried to break them. See penetration testing for medical devices.
Traceability. Links from threats to requirements, controls, and test results.
Cybersecurity labeling. What users and hospitals need to know to run the device securely.
Postmarket and vulnerability management plans. How you will watch for, triage, disclose, and patch issues once the device ships.

Blue Goat Cyber prepares cybersecurity documents and security testing. We do not provide general software verification and validation.

Step 4: Choose what to buy

Most teams fall into one of three situations.

Your situation	What usually fits
Little or no cybersecurity work done, submission coming	A full premarket cybersecurity package
Work done in house or by another firm, unsure if it is enough	A gap assessment first, then only the missing pieces
Documents in good shape, need independent testing	Medical device penetration testing

After clearance, many teams add ongoing help for SBOM monitoring, vulnerability triage, and device changes through the MedTech Cybersecurity Advisory. Our Services page groups every option by situation if you want to compare.

Step 5: Budget and timing

Prices depend on device complexity, the number of interfaces, and how much work already exists. As a rough guide for Blue Goat Cyber engagements:

Gap assessments start from $5,000.
Penetration tests for simple devices start around $15,000, before travel.
The MedTech Cybersecurity Advisory is starting at $5,000 a month.
Full premarket packages are quoted as a fixed fee after a discovery call.

Start at least three to six months before your planned submission. Penetration testing needs stable hardware and software, and fixing findings takes time. Our pen test scope estimator gives a quick range.

Step 6: Questions to ask any cybersecurity partner

Use these on every shortlist, including us.

Do you work only on medical devices? Generalists often miss how threats link to patient harm.
Can I see a sample deliverable? Ask for a redacted threat model, risk assessment, or test report.
Is the price fixed, and what is in scope? Open hourly billing tends to grow after the first FDA question.
What are your retest terms? Blue Goat Cyber includes unlimited retests until every finding with uncontrolled risk is closed.
What happens if the FDA asks a cybersecurity question? At Blue Goat Cyber, if the FDA raises a cybersecurity question, we answer it at no extra cost until the cybersecurity portion is closed.
Will you test the device itself? A web scan or network sweep is not a medical device penetration test. Hardware, firmware, wireless, app, and cloud should all be in scope where they apply.
Who does the work? Find out whether the people on the sales call are the people writing your documents.
Do you sell a platform I must license? The FDA reviews documents and evidence, not dashboards.

For more on common vendor mistakes, see 10 reasons medical device cybersecurity vendors fail you.

Common buying mistakes

Buying a pen test before a threat model. Testing should follow the threats you identified, or the report will not trace to your risk file.
Treating the SBOM as a one-time export. The FDA expects support status and vulnerability review, and you will need to keep it current after release.
Waiting for a hold letter. Answering FDA questions under a deadline costs more than preparing well up front. If you already have one, see our deficiency response playbook.
Splitting work across firms with no single owner. Threat model, risk assessment, and test results must agree with each other.

How Blue Goat Cyber approaches this

We start with a free discovery call to learn your device, pathway, and timeline. You get a fixed-fee proposal with defined deliverables, and nothing is charged before you approve it. Our team has supported 275+ devices with no cybersecurity-related rejections to date. Every deliverable is written to the February 2026 guidance and organized for eSTAR.

FAQ

Next step

Not sure what you need? Book a free discovery call and we will tell you which pieces fit your device and timeline, or try the free Threat Model Starter.

FDA Cybersecurity Requirements: A Buyer's Guide for Medical Device Teams

Key Takeaways