Postmarket Cybersecurity Readiness Plan

Premarket → Launch → Operate. A practical operating model mapped to statutory duties and guidance recommendations. A three-phase plan for the cybersecurity work that starts before your 510(k) is filed, lights up before your first device ships, and runs for the life of the product. Built for Regulatory, Quality, Engineering, and Executive leaders shipping connected medical devices in 2026.

Our Postmarket Services

The three phases at a glance

• Phase 1 - Premarket Build. Before 510(k) filing.
• Phase 2 - Pre-Launch Activation. Between clearance and first ship.
• Phase 3 - Postmarket Operate. Life of device.

The Executive Brief

The FDA pushed cybersecurity left. It is no longer something you add after clearance, it is a documented, inspectable program the FDA reviews as part of your 510(k), De Novo, or PMA. Missing statutory submission content can prevent acceptance. Postmarket shortcomings require assessment under applicable quality, reporting, and enforcement requirements; recall is not automatic.

The one-paragraph version

Section 524B of the FD&C Act establishes cybersecurity duties for covered 510(k), De Novo, PMA, PDP, and HDE submissions: a qualifying "cyber device" submission must include a postmarket cybersecurity plan, SBOM, coordinated vulnerability disclosure (CVD) policy, and patch process. The FDA February 3, 2026 final guidance and QMSR (21 CFR Part 820) incorporating ISO 13485:2016 raised the bar further. Post-clearance, operate a risk-based program. Monthly triage, quarterly KPI reporting, annual tests, and exercises below illustrate one operating model, not FDA-prescribed frequencies. Assess manufacturer MDR and Part 806 duties separately.

The timing nobody told you about

• Before 510(k) filing. Cybersecurity plan, SBOM baseline, CVD policy, patch process, and IR plan authored and reviewed as submission documents.
• Before first ship. All plans made operational: SBOM tooling live in CI/CD, vulnerability monitoring active, CVD inbox standing, MDS2 published.
• Life of device. Monthly triage, quarterly KPI reports, annual pen test and IR exercise, MedWatch decision support for every cybersecurity event.

What the FDA can do at each phase

Why this is uniquely hard for medical devices

Unlike enterprise software, medical devices have decade-long field lifespans, constrained update windows, patient-safety implications for every patch decision, and a regulatory framework that treats your postmarket security program as an inspectable quality record. A vulnerability that would be a one-hour hotfix in SaaS is a multi-month change-controlled event tied to 21 CFR Part 820 and ISO 14971.

The Three Phases

Premarket Build · Pre-Launch Activation · Postmarket Operate. Each phase has specific deliverables, owners, and regulatory tie-ins. Use this section as your program roadmap.

Phase 1 - Premarket Build

Before covered 510(k) / De Novo / PMA filing. Supply applicable statutory content and supporting risk-based evidence. The guidance does not require every internal procedure as a separate submission document.

Cybersecurity Risk Management Plan

Author the postmarket plan the FDA reviews as part of your submission. Defines how you will identify, assess, and address cybersecurity vulnerabilities for the life of the device.

• Deliverables. Postmarket Cybersecurity Plan (governance, cadence, roles); cybersecurity RACI across Product, Quality, Regulatory, Support; threat model and security architecture views (per AAMI TIR57 / ANSI/AAMI SW96:2023).
• Owners. Product Security Lead · VP Quality / Regulatory.
• FDA / Standards tie. 21 USC §524B(b)(1) and FDA guidance V. The cybersecurity plan is a required element of a "cyber device" submission.

SBOM Baseline

Generate the first complete Software Bill of Materials in a machine-readable format. This is the artifact the FDA uses to evaluate your vulnerability monitoring capability.

• Deliverables. CycloneDX or SPDX SBOM from production build; all transitive dependencies, version pins, suppliers; SBOM maintenance and distribution policy.
• Owners. Engineering · Product Security.
• FDA / Standards tie. Section 524B(b)(3) requires an SBOM for covered submissions. Guidance §V.A.4(a)-(b) recommends component coverage, maintenance, and machine-readable formats; no SPDX or CycloneDX version floor is specified. Assess any voluntary standard separately.

Vulnerability Monitoring Plan

Document exactly how you will correlate SBOM components to CVE feeds after clearance, who triages, and what the SLAs are for each severity tier.

• Deliverables. Monitoring source list (NVD, CISA KEV, H-ISAC, vendor PSIRTs); risk-based triage SLAs by CVSS severity; named triage owner and escalation path.
• Owners. Product Security · Quality.
• FDA / Standards tie. Section 524B(b)(1) requires the monitoring and disclosure plan for covered submissions. Guidance §VII.C.1 recommends supporting procedures; justify operational monitoring using device-specific risk.

Coordinated Vulnerability Disclosure (CVD) Policy

Publish the intake path and response process for external security researchers, a required submission element and a patient-safety expectation.

• Deliverables. CVD policy with security contact, scope, and response SLAs; internal triage workflow tied to patch cadence; references to ISO/IEC 29147 and 30111.
• Owners. Product Security · Legal · Communications.
• FDA / Standards tie. Section 524B(b)(1) requires a plan including coordinated vulnerability disclosure and related procedures for covered submissions. Guidance §VII.C.1 provides nonbinding content recommendations.

Patch & Update Process Description

Document the change-controlled workflow for delivering security patches: how updates are tested, signed, distributed, and validated in the field.

• Deliverables. Patch development and testing under 21 CFR 820 change control; update delivery mechanism (OTA, service, CDN); rollback and failure handling procedures.
• Owners. Engineering · Regulatory · Quality.
• FDA / Standards tie. Guidance §V.B.2 and Appendix 4 recommend updateability/patchability views; §V.C recommends cybersecurity testing. The manufacturer determines and performs appropriate verification and validation for the change.

Incident Response Plan

Define the decision logic for cybersecurity incidents: triage, containment, MedWatch reporting threshold, customer notification, and corrective action.

• Deliverables. IR playbook with roles, comms tree, and escalation; MedWatch reportability decision tree; corrective action and post-incident review process.
• Owners. Product Security · Regulatory Affairs · Executive Sponsor.
• FDA / Standards tie. 21 CFR 803: cybersecurity events require assessment under the manufacturer MDR criteria in 21 CFR 803.50. The FDA expects a documented decision process.

Need help building Phase 1 artifacts? We author the full premarket cyber package, supporting applicable Section 524B submission duties; acceptance remains the FDA's decision. Our premarket services.

Phase 2 - Pre-Launch Activation

Between clearance and the first commercial unit. Make every premarket plan operational before Day 1. Plans on paper are not enough. Vulnerability discovery, incident information, and correction initiation can create different action or reporting timelines. Shipment alone does not start a universal MDR or CVD deadline.

Wire SBOM Tooling to CI/CD

SBOM generation runs automatically on every release build. Output is stored, queryable, and diffable. No manual steps.

• Deliverables. CycloneDX / SPDX SBOM generated on every build; per-device, per-version SBOM repository; supplier SBOM intake workflow operating.
• Owners. Engineering · DevSecOps.
• FDA / Standards tie. FDA guidance plus IEC 81001-5-1 5.6: SBOM is a living artifact maintained throughout the device lifecycle.

Activate Vulnerability Monitoring Feeds

Live correlation of SBOM components to NVD, CISA KEV, ICS-CERT, vendor PSIRTs, and H-ISAC. Daily digest routed to a named triage owner.

• Deliverables. SBOM-to-CVE pipeline running in production; threat intel subscriptions active (H-ISAC, CISA, vendor PSIRTs); on-call rotation defined.
• Owners. Product Security · SOC / Managed Service Partner.
• FDA / Standards tie. FDA guidance §VII.C.1 and §V.A.6 recommend lifecycle procedures and monitoring. Choose and justify the monitoring cadence using device-specific risk.

Stand Up the CVD Inbox

security@ inbox monitored, security.txt published on company and product domains, PGP key distributed, acknowledgement workflow live.

• Deliverables. security.txt live at /.well-known/security.txt; security@ inbox routed to a 24/7 monitored channel; acknowledgement SLA ≤ 72h verified by test report.
• Owners. Product Security · IT · Communications.
• FDA / Standards tie. FDA guidance §VII.C.1 recommends coordinated-disclosure procedures. A security.txt file, PGP key, and 72-hour acknowledgment target are implementation choices, not universal statutory requirements.

Publish MDS2 + Customer Security Pack

Hospitals, IDNs, and procurement teams expect a current MDS2 and a security documentation pack at point of sale. Missing either is now an RFP gating issue.

• Deliverables. MDS2 (HIMSS / NEMA) per device model; customer-facing security white paper; SBOM customer-distribution policy (NDA-gated).
• Owners. Product Marketing · Product Security · Customer Success.
• FDA / Standards tie. FDA guidance §VI.A provides risk-based labeling recommendations. MDS2 and customer packs may support procurement, but the FDA does not universally require an MDS2 questionnaire.

Tabletop the IR Plan

Run at least one full tabletop cybersecurity incident exercise. Validate communications tree, MedWatch decision logic, and corrective-action workflow before any real event.

• Deliverables. Tabletop exercise after-action report; updated IR plan with gaps addressed; MedWatch decision tree signed off by Regulatory Affairs.
• Owners. Product Security · Regulatory Affairs · Quality.
• FDA / Standards tie. FDA guidance: IR readiness is part of the inspectable postmarket program. Tabletop evidence can support readiness; no universal exercise requirement or automatic FDA or notified-body acceptance is claimed.

Train QMS, Lock Vendor SLAs

Every quality and engineering team member understands their role in the cyber program. Arrange appropriate supplier security responsibilities and component information; a universal contractual obligation is not imposed on every vendor by this guidance.

• Deliverables. Cybersecurity training records in QMS; vendor security SLA template executed with key suppliers; cyber program integrated into 21 CFR 820 change control SOPs.
• Owners. Quality · Procurement · Product Security.
• FDA / Standards tie. QMSR (21 CFR Part 820): training and supplier controls are inspectable quality records.

Phase 3 - Postmarket Operate

Life of device, ongoing. Run the continuous loop: monthly triage, quarterly KPI review, annual exercises, and event-driven response. Every cycle produces inspectable evidence for the FDA, notified bodies, and your board.

Monthly: CVE Triage + SBOM Refresh

Every new CVE is correlated against the device SBOM. Each match is triaged to closure - patch, risk acceptance, or compensating control - using manufacturer risk criteria and justified timing; urgent findings must not wait for a periodic review.

• Deliverables. Monthly triage report (open, resolved, accepted risk); updated SBOM reflecting any component changes; triage records in QMS.
• Owners. Product Security · Quality.
• FDA / Standards tie. IEC 81001-5-1 5.7 plus FDA guidance §V.A.6 and §VII.C.1 recommend lifecycle risk management and monitoring. Document risk-owner disposition using manufacturer criteria.

Regular-Cycle and Urgent Patch Delivery Under Change Control

Security patches are developed, tested, approved, and delivered through the 21 CFR 820 change control process. Section 524B(b)(2) requires updates and patches for known unacceptable vulnerabilities on a reasonably justified regular cycle, and as soon as possible out of cycle for critical vulnerabilities that could cause uncontrolled risks. Retain proportionate change records and testing.

• Deliverables. Change record for every security patch; regression test evidence; customer patch notification and deployment guide.
• Owners. Engineering · Regulatory Affairs · Quality.
• FDA / Standards tie. QMSR (21 CFR Part 820): patches are device changes and require design history file documentation.

Quarterly: KPI Review + MDS2 Currency

Measure the eight postmarket cybersecurity KPIs, review against thresholds, and escalate if any metric is out of bounds. Update MDS2 for any product change.

• Deliverables. Quarterly KPI dashboard (8 metrics, see Part 3); updated MDS2 if product configuration changed; board / exec summary if any KPI breaches threshold.
• Owners. Product Security · Quality · VP Regulatory.
• FDA / Standards tie. FDA guidance §VI.A recommends cybersecurity labeling and communication. Quarterly reviews and eight KPIs illustrate internal program choices, not mandated reporting frequencies.

Annually: Pen Test, IR Exercise, Board Report

Annual penetration test across all device interfaces, full-scale incident response exercise, and an executive board report on the state of the cybersecurity program.

• Deliverables. Annual pen test report with remediation tracking; IR exercise after-action report; board cybersecurity briefing deck.
• Owners. Product Security · Executive Sponsor · Board.
• FDA / Standards tie. FDA guidance: §V.C recommends risk-based cybersecurity testing; it does not prescribe annual penetration tests or incident exercises. Set timing from risk, changes, and agreed scope.

Event-Driven: MedWatch, Recall, EOL

When a cybersecurity event occurs - a vulnerability causing patient harm risk, a confirmed exploit, or an end-of-life component with no patch - follow the defined escalation and reporting workflow.

• Deliverables. MedWatch reportability decision and filing; recall or field safety corrective action if required; EOL component migration plan activated.
• Owners. Regulatory Affairs · Executive Sponsor · Legal.
• FDA / Standards tie. 21 CFR 803 plus FDA postmarket guidance: cybersecurity events require assessment against the death, serious-injury, and malfunction criteria in 21 CFR 803.50; patient-harm risk alone does not establish MDR reportability. The FDA expects a documented and practiced decision process.

Always-On: Inspectable Evidence Package

Every cycle produces records that can be pulled for an FDA inspection, notified body audit, or customer due diligence request with no scramble.

• Deliverables. Triage logs, patch records, training records in QMS; current SBOM, CVD log, and KPI history; audit-ready evidence package per device per year.
• Owners. Quality · Product Security.
• FDA / Standards tie. QMSR (21 CFR Part 820): cybersecurity records are quality records. FDA inspectors expect to pull them on-site.

The KPI Dashboard

Eight illustrative internal metrics. Select owners, targets, and escalation using manufacturer procedures. These are not FDA-prescribed KPIs or safe waiting periods. Critical vulnerabilities that could cause uncontrolled risks need updates and patches as soon as possible out of cycle.

Frequently asked questions

Does Section 524B require a postmarket cybersecurity plan?

Yes. Section 524B(b)(1) requires sponsors of covered cyber-device submissions to submit a plan to monitor, identify, and address postmarket cybersecurity vulnerabilities and exploits, including coordinated vulnerability disclosure and related procedures. Section VII.C.1 of the February 3, 2026 final guidance recommends supporting plan content; distinguish those recommendations from the statutory duty. Submitting a device without one is grounds for the FDA to refuse to accept the submission under the RTA process.

When does postmarket cybersecurity monitoring actually start?

Before your first device ships. The FDA expects your SBOM pipeline, CVE feed monitoring, CVD inbox, and patch process to be live and tested at launch, not stood up months later. Activate the program before devices enter the field. The 2016 guidance's 30-day communication and 60-day remediation provisions are conditional Part 806 enforcement-discretion criteria measured from learning of a vulnerability, not general CVD disclosure or FDA-reporting deadlines. Assess reporting separately.

How often do we need to update the SBOM after clearance?

Maintain inventories that accurately represent supported software versions and review them when shipped components change. Per-build regeneration is one useful company practice, not a universal FDA mandate. The guidance recommends ongoing vulnerability management but prescribes no single SBOM update interval.

What triggers a MedWatch report for a cybersecurity issue?

A cybersecurity vulnerability that causes or contributes to a death, serious injury, or malfunction that would likely cause a death or serious injury if it recurred. A documented exploit is not necessary for an MDR, but uncontrolled risk alone does not establish reportability. Apply the criteria in 21 CFR 803.50 to the available information. Your postmarket plan needs a documented decision path for MedWatch reporting so triage is defensible.

How does coordinated vulnerability disclosure fit into the postmarket plan?

Section 524B(b)(1) requires a monitoring plan including coordinated vulnerability disclosure and related procedures for covered cyber-device submissions. Document coordinated-disclosure and response procedures. A published policy and monitored intake channel are implementation choices; justify timing using device-specific risk. The guidance points to ISO/IEC 29147 and 30111 as the operational references. The referenced standards and example policy structure are useful implementation references, not universally mandated formats.

What is an SBOM attestation, and do we need one every year?

An SBOM attestation is a signed statement that the SBOM you provided reflects the current build. The guidance recommends maintaining component information, but does not require a separate SBOM attestation at submission, on updates, or annually. Check any purchaser-specific contractual request rather than assuming an annual attestation requirement.

How Blue Goat Cyber Fits

You do not need to hire a security team to run this plan. Blue Goat Cyber is the MedTech-only cybersecurity firm that builds the premarket package with you, activates the program before launch, and operates the postmarket loop on a fixed-fee subscription.

• Phase 1 - Build. We author the cybersecurity plan, threat model, SBOM baseline, CVD policy, and patch process for your submission, supporting applicable Section 524B submission duties; acceptance remains the FDA's decision.
• Phase 2 - Activate. We wire SBOM tooling, monitor CVE feeds, stand up your CVD inbox, publish your MDS2, and run your first IR tabletop, before the first device ships.
• Phase 3 - Operate. Monthly triage, quarterly KPI report, annual pen test, MedWatch decision support, and an inspectable evidence package, on a fixed-fee retainer.

Why MedTech leaders choose us

• Every engagement is a medical device. We don't split focus with enterprise IT clients.
• The team that authored your §524B plan is the team that operates it after clearance. No handoff, no ramp-up.
• 275+ FDA submissions supported, zero cybersecurity rejections. We carry the FDA cybersecurity deficiency commitment.
• Post-market services on a fixed-fee subscription. Predictable cost, no scope creep.
• When an incident happens, we are already on call with your device context loaded.

Track record

• 275+ FDA submissions supported, zero cybersecurity rejections.
• 3 phases covered, end to end.

Ready to run a compliant postmarket program?

Book a free 30-minute strategy session. We'll review your current program, identify gaps, and give you a fixed-fee quote for all three phases, within 24 hours.

What happens next. Send us your device type, clearance date, and how postmarket monitoring runs today. Within one business day you get a written read on the gaps that matter most and a fixed-price scope for closing them.

Explore our post-market cybersecurity services, SBOM lifecycle monitoring, annual penetration testing, and FDA premarket submission support.

Where to go next

• Postmarket SBOM Maintenance for Medical Devices - the regeneration cadence your plan should commit to.
• Postmarket Cadence Calculator - set a defensible monitoring, triage, and patch cadence.