Postmarket Cybersecurity Readiness Plan

Premarket → Launch → Operate. What the FDA expects, and when. A three-phase plan for the cybersecurity work that starts before your 510(k) is filed, lights up before your first device ships, and runs for the life of the product. Built for Regulatory, Quality, Engineering, and Executive leaders shipping connected medical devices in 2026.

Our Postmarket Services

The three phases at a glance

• Phase 1 - Premarket Build. Before 510(k) filing.
• Phase 2 - Pre-Launch Activation. Between clearance and first ship.
• Phase 3 - Postmarket Operate. Life of device.

The Executive Brief

The FDA pushed cybersecurity left. It is no longer something you add after clearance, it is a documented, inspectable program the FDA reviews as part of your 510(k), De Novo, or PMA. Miss it and your submission is refused. Operate it badly and your devices get recalled.

The one-paragraph version

Section 524B of the FD&C Act made cybersecurity a precondition for clearance: every "cyber device" submission must include a postmarket cybersecurity plan, SBOM, coordinated vulnerability disclosure (CVD) policy, and patch process. The FDA's Feb 2026 final guidance and QMSR (21 CFR Part 820) incorporating IEC 81001-5-1 raised the bar further. Post-clearance, you now run an ongoing program: monthly CVE triage against your SBOM, quarterly KPI reporting, annual pen tests and IR exercises, and a MedWatch-reportable decision workflow when something goes wrong.

The timing nobody told you about

• Before 510(k) filing. Cybersecurity plan, SBOM baseline, CVD policy, patch process, and IR plan authored and reviewed as submission documents.
• Before first ship. All plans made operational: SBOM tooling live in CI/CD, vulnerability monitoring active, CVD inbox standing, MDS2 published.
• Life of device. Monthly triage, quarterly KPI reports, annual pen test and IR exercise, MedWatch decision support for every cybersecurity event.

What the FDA can do at each phase

Why this is uniquely hard for medical devices

Unlike enterprise software, medical devices have decade-long field lifespans, constrained update windows, patient-safety implications for every patch decision, and a regulatory framework that treats your postmarket security program as an inspectable quality record. A vulnerability that would be a one-hour hotfix in SaaS is a multi-month change-controlled event tied to 21 CFR Part 820 and ISO 14971.

The Three Phases

Premarket Build · Pre-Launch Activation · Postmarket Operate. Each phase has specific deliverables, owners, and regulatory tie-ins. Use this section as your program roadmap.

Phase 1 - Premarket Build

Before 510(k) / De Novo / PMA filing. Author the complete postmarket program as submission documents. Every plan, policy, and process description the FDA reviews on day one.

Cybersecurity Risk Management Plan

Author the postmarket plan the FDA reviews as part of your submission. Defines how you will identify, assess, and address cybersecurity vulnerabilities for the life of the device.

• Deliverables. Postmarket Cybersecurity Plan (governance, cadence, roles); cybersecurity RACI across Product, Quality, Regulatory, Support; threat model and security architecture views (per AAMI TIR57 / ANSI/AAMI SW96:2023).
• Owners. Product Security Lead · VP Quality / Regulatory.
• FDA / Standards tie. 21 USC §524B(b)(1) and FDA guidance V. The cybersecurity plan is a required element of a "cyber device" submission.

SBOM Baseline

Generate the first complete Software Bill of Materials in a machine-readable format. This is the artifact the FDA uses to evaluate your vulnerability monitoring capability.

• Deliverables. CycloneDX or SPDX SBOM from production build; all transitive dependencies, version pins, suppliers; SBOM maintenance and distribution policy.
• Owners. Engineering · Product Security.
• FDA / Standards tie. FDA guidance VI.B requires a machine-readable SBOM with transitive dependencies. IEC 81001-5-1 5.6 requires SBOM throughout lifecycle.

Vulnerability Monitoring Plan

Document exactly how you will correlate SBOM components to CVE feeds after clearance, who triages, and what the SLAs are for each severity tier.

• Deliverables. Monitoring source list (NVD, CISA KEV, H-ISAC, vendor PSIRTs); risk-based triage SLAs by CVSS severity; named triage owner and escalation path.
• Owners. Product Security · Quality.
• FDA / Standards tie. FDA guidance VI.A requires monitoring to be documented and operational post-clearance. IEC 81001-5-1 5.7 requires ongoing TPLC vulnerability tracking.

Coordinated Vulnerability Disclosure (CVD) Policy

Publish the intake path and response process for external security researchers, a required submission element and a patient-safety expectation.

• Deliverables. CVD policy with security contact, scope, and response SLAs; internal triage workflow tied to patch cadence; references to ISO/IEC 29147 and 30111.
• Owners. Product Security · Legal · Communications.
• FDA / Standards tie. FDA guidance VII explicitly requires CVD. Absence of a documented program is a common deficiency.

Patch & Update Process Description

Document the change-controlled workflow for delivering security patches: how updates are tested, signed, distributed, and validated in the field.

• Deliverables. Patch development and testing under 21 CFR 820 change control; update delivery mechanism (OTA, service, CDN); rollback and failure handling procedures.
• Owners. Engineering · Regulatory · Quality.
• FDA / Standards tie. FDA guidance VI.C requires an updateability architecture view; the update mechanism must be validated end-to-end.

Incident Response Plan

Define the decision logic for cybersecurity incidents: triage, containment, MedWatch reporting threshold, customer notification, and corrective action.

• Deliverables. IR playbook with roles, comms tree, and escalation; MedWatch reportability decision tree; corrective action and post-incident review process.
• Owners. Product Security · Regulatory Affairs · Executive Sponsor.
• FDA / Standards tie. 21 CFR 803: cybersecurity events causing patient harm are MedWatch-reportable. The FDA expects a documented decision process.

Need help building Phase 1 artifacts? We author the full premarket cyber package, RTA-proof on §524B elements. Our premarket services.

Phase 2 - Pre-Launch Activation

Between clearance and the first commercial unit. Make every premarket plan operational before Day 1. Plans on paper are not enough. The moment a device is in a hospital, the clock starts on CVD response, MDS2 currency, and MedWatch reporting.

Wire SBOM Tooling to CI/CD

SBOM generation runs automatically on every release build. Output is stored, queryable, and diffable. No manual steps.

• Deliverables. CycloneDX / SPDX SBOM generated on every build; per-device, per-version SBOM repository; supplier SBOM intake workflow operating.
• Owners. Engineering · DevSecOps.
• FDA / Standards tie. FDA guidance plus IEC 81001-5-1 5.6: SBOM is a living artifact maintained throughout the device lifecycle.

Activate Vulnerability Monitoring Feeds

Live correlation of SBOM components to NVD, CISA KEV, ICS-CERT, vendor PSIRTs, and H-ISAC. Daily digest routed to a named triage owner.

• Deliverables. SBOM-to-CVE pipeline running in production; threat intel subscriptions active (H-ISAC, CISA, vendor PSIRTs); on-call rotation defined.
• Owners. Product Security · SOC / Managed Service Partner.
• FDA / Standards tie. FDA guidance VI.A: monitoring must be active, not aspirational, the moment devices are in the field.

Stand Up the CVD Inbox

security@ inbox monitored, security.txt published on company and product domains, PGP key distributed, acknowledgement workflow live.

• Deliverables. security.txt live at /.well-known/security.txt; security@ inbox routed to a 24/7 monitored channel; acknowledgement SLA ≤ 72h verified by test report.
• Owners. Product Security · IT · Communications.
• FDA / Standards tie. FDA guidance VII: CVD must be operational, with a published intake path, before devices ship.

Publish MDS2 + Customer Security Pack

Hospitals, IDNs, and procurement teams expect a current MDS2 and a security documentation pack at point of sale. Missing either is now an RFP gating issue.

• Deliverables. MDS2 (HIMSS / NEMA) per device model; customer-facing security white paper; SBOM customer-distribution policy (NDA-gated).
• Owners. Product Marketing · Product Security · Customer Success.
• FDA / Standards tie. FDA guidance VI.D plus IMDRF transparency principles: timely customer communication is part of a recognized program.

Tabletop the IR Plan

Run at least one full tabletop cybersecurity incident exercise. Validate communications tree, MedWatch decision logic, and corrective-action workflow before any real event.

• Deliverables. Tabletop exercise after-action report; updated IR plan with gaps addressed; MedWatch decision tree signed off by Regulatory Affairs.
• Owners. Product Security · Regulatory Affairs · Quality.
• FDA / Standards tie. FDA guidance: IR readiness is part of the inspectable postmarket program. Tabletop evidence satisfies both the FDA and notified bodies.

Train QMS, Lock Vendor SLAs

Every quality and engineering team member understands their role in the cyber program. Every third-party software vendor has a contractual obligation to provide CVE notifications and SBOMs.

• Deliverables. Cybersecurity training records in QMS; vendor security SLA template executed with key suppliers; cyber program integrated into 21 CFR 820 change control SOPs.
• Owners. Quality · Procurement · Product Security.
• FDA / Standards tie. QMSR (21 CFR Part 820): training and supplier controls are inspectable quality records.

Phase 3 - Postmarket Operate

Life of device, ongoing. Run the continuous loop: monthly triage, quarterly KPI review, annual exercises, and event-driven response. Every cycle produces inspectable evidence for the FDA, notified bodies, and your board.

Monthly: CVE Triage + SBOM Refresh

Every new CVE is correlated against the device SBOM. Each match is triaged to closure - patch, risk acceptance, or compensating control - within the defined SLA.

• Deliverables. Monthly triage report (open, resolved, accepted risk); updated SBOM reflecting any component changes; triage records in QMS.
• Owners. Product Security · Quality.
• FDA / Standards tie. IEC 81001-5-1 5.7 plus FDA guidance VI.A: ongoing monitoring with documented disposition is the core of an inspectable postmarket program.

Monthly: Patch Delivery Under Change Control

Security patches are developed, tested, approved, and delivered through the 21 CFR 820 change control process. No out-of-band hotfixes without a documented rationale.

• Deliverables. Change record for every security patch; regression test evidence; customer patch notification and deployment guide.
• Owners. Engineering · Regulatory Affairs · Quality.
• FDA / Standards tie. QMSR (21 CFR Part 820): patches are device changes and require design history file documentation.

Quarterly: KPI Review + MDS2 Currency

Measure the eight postmarket cybersecurity KPIs, review against thresholds, and escalate if any metric is out of bounds. Update MDS2 for any product change.

• Deliverables. Quarterly KPI dashboard (8 metrics, see Part 3); updated MDS2 if product configuration changed; board / exec summary if any KPI breaches threshold.
• Owners. Product Security · Quality · VP Regulatory.
• FDA / Standards tie. FDA guidance VI.D: transparency and communication cadence with customers is part of the recognized program.

Annually: Pen Test, IR Exercise, Board Report

Annual penetration test across all device interfaces, full-scale incident response exercise, and an executive board report on the state of the cybersecurity program.

• Deliverables. Annual pen test report with remediation tracking; IR exercise after-action report; board cybersecurity briefing deck.
• Owners. Product Security · Executive Sponsor · Board.
• FDA / Standards tie. FDA guidance: annual pen testing and IR exercises are part of a credible, demonstrable postmarket program.

Event-Driven: MedWatch, Recall, EOL

When a cybersecurity event occurs - a vulnerability causing patient harm risk, a confirmed exploit, or an end-of-life component with no patch - follow the defined escalation and reporting workflow.

• Deliverables. MedWatch reportability decision and filing; recall or field safety corrective action if required; EOL component migration plan activated.
• Owners. Regulatory Affairs · Executive Sponsor · Legal.
• FDA / Standards tie. 21 CFR 803 plus FDA postmarket guidance: cybersecurity events with patient harm risk are MDR-reportable. The FDA expects a documented and practiced decision process.

Always-On: Inspectable Evidence Package

Every cycle produces records that can be pulled for an FDA inspection, notified body audit, or customer due diligence request with no scramble.

• Deliverables. Triage logs, patch records, training records in QMS; current SBOM, CVD log, and KPI history; audit-ready evidence package per device per year.
• Owners. Quality · Product Security.
• FDA / Standards tie. QMSR (21 CFR Part 820): cybersecurity records are quality records. FDA inspectors expect to pull them on-site.

The KPI Dashboard

Eight metrics every postmarket cybersecurity program reports on. If any metric is out of bounds, it goes to the board.

Frequently asked questions

Does Section 524B require a postmarket cybersecurity plan?

Yes. Section 524B(b)(2) requires manufacturers to submit a plan to monitor, identify, and address postmarket cybersecurity vulnerabilities and exploits, including coordinated vulnerability disclosure and related procedures. The February 3, 2026 final guidance operationalizes what that plan must contain. Submitting a device without one is grounds for the FDA to refuse to accept the submission under the RTA process.

When does postmarket cybersecurity monitoring actually start?

Before your first device ships. The FDA expects your SBOM pipeline, CVE feed monitoring, CVD inbox, and patch process to be live and tested at launch, not stood up months later. Manufacturers who wait until they have field devices to activate the program consistently miss the 60-day disclosure and reporting windows the guidance sets for coordinated vulnerability disclosure.

How often do we need to update the SBOM after clearance?

Every build that reaches a user, and any time a monitored component changes. The 2026 guidance treats the SBOM as a living artifact, not a one-time submission deliverable. Postmarket vulnerability triage relies on matching new CVEs against the current SBOM, so a stale SBOM means the manufacturer will miss vulnerabilities that affect deployed devices.

What triggers a MedWatch report for a cybersecurity issue?

A cybersecurity vulnerability that causes or contributes to a death, serious injury, or malfunction that would likely cause a death or serious injury if it recurred. The FDA has clarified that uncontrolled cybersecurity risk in a deployed device meets the malfunction threshold even without a documented exploit. Your postmarket plan needs a documented decision path for MedWatch reporting so triage is defensible.

How does coordinated vulnerability disclosure fit into the postmarket plan?

CVD is one of four required pillars of the postmarket plan under the February 2026 guidance. You need a published disclosure policy, a monitored intake channel, a documented triage process, and evidence that you can execute a coordinated patch within reasonable timeframes. The guidance points to ISO/IEC 29147 and 30111 as the operational references. Missing any of the four pieces is a common deficiency.

What is an SBOM attestation, and do we need one every year?

An SBOM attestation is a signed statement that the SBOM you provided reflects the current build. The 2026 guidance expects manufacturers to keep SBOMs current on every release, and expects attestations on submission and on material updates. Some purchasers (VA, DoD, larger IDNs) require an annual attestation as part of procurement. Treat annual attestation as a working assumption for enterprise-hospital-facing devices.

How Blue Goat Cyber Fits

You do not need to hire a security team to run this plan. Blue Goat Cyber is the MedTech-only cybersecurity firm that builds the premarket package with you, activates the program before launch, and operates the postmarket loop on a fixed-fee subscription.

• Phase 1 - Build. We author the cybersecurity plan, threat model, SBOM baseline, CVD policy, and patch process for your submission. RTA-proof on §524B elements.
• Phase 2 - Activate. We wire SBOM tooling, monitor CVE feeds, stand up your CVD inbox, publish your MDS2, and run your first IR tabletop, before the first device ships.
• Phase 3 - Operate. Monthly triage, quarterly KPI report, annual pen test, MedWatch decision support, and an inspectable evidence package, on a fixed-fee retainer.

Why MedTech leaders choose us

• Every engagement is a medical device. We don't split focus with enterprise IT clients.
• The team that authored your §524B plan is the team that operates it after clearance. No handoff, no ramp-up.
• 275+ devices supported with no cybersecurity-related rejections to date. We carry the FDA cybersecurity deficiency commitment.
• Post-market services on a fixed-fee subscription. Predictable cost, no scope creep.
• When an incident happens, we are already on call with your device context loaded.

Track record

• 275+ devices supported.
• Zero rejections.
• 3 phases covered, end to end.

Ready to run a compliant postmarket program?

Book a free 30-minute strategy session. We'll review your current program, identify gaps, and give you a fixed-fee quote for all three phases, within 24 hours.

What happens next. Send us your device type, clearance date, and how postmarket monitoring runs today. Within one business day you get a written read on the gaps that matter most and a fixed-price scope for closing them.

Explore our post-market cybersecurity services, SBOM lifecycle monitoring, annual penetration testing, and FDA premarket submission support.

Where to go next

• Postmarket SBOM Maintenance for Medical Devices - the regeneration cadence your plan should commit to.
• Postmarket Cadence Calculator - set a defensible monitoring, triage and patch cadence.