Question 1

What is medical device cybersecurity?

Accepted Answer

Medical device cybersecurity is the discipline of designing, validating, and maintaining medical devices so they resist, detect, and recover from cyber threats - protecting patient safety, device performance, and the data they generate. In practice it spans threat modeling, secure architecture and coding, SBOM and supply-chain hygiene, verification testing (static analysis, fuzzing, penetration testing), regulatory documentation, and postmarket vulnerability management. Unlike enterprise IT security, decisions are bounded by clinical workflow, hardware lifetimes that often exceed a decade, and the FDA's expectation that security controls are traceable to safety risk.

Question 2

What does the FDA require for premarket cybersecurity submissions?

Accepted Answer

Under FDA Section 524B and the FDA's February 3, 2026 final premarket cybersecurity guidance, premarket submissions for cyber devices must include a Secure Product Development Framework (SPDF), threat model, cybersecurity risk assessment, SBOM with vulnerability assessment, security testing (including pen test), labeling, and a postmarket cybersecurity management plan. The FDA can refuse to accept (RTA) submissions that omit these.

Question 3

What is an SBOM and why does the FDA require one?

Accepted Answer

An SBOM (Software Bill of Materials) is a machine-readable inventory of every software component in a device - proprietary, open-source, and commercial. The FDA requires an SBOM in CycloneDX or SPDX format so reviewers and operators can monitor for new vulnerabilities affecting any component over the device's life.

Question 4

How is threat modeling different from a risk assessment?

Accepted Answer

A cybersecurity risk assessment quantifies the probability and impact of identified risks. Threat modeling is the upstream activity that systematically discovers those risks - mapping data flows, identifying threat actors and attack vectors (often via STRIDE), and proposing mitigations. The FDA expects both, with the threat model driving the risk assessment.

Question 5

Who should listen to The Med Device Cyber Podcast?

Accepted Answer

MedTech founders, regulatory affairs leaders, quality and product security engineers, software/firmware developers, clinical IT teams, and anyone navigating FDA, EU MDR/IVDR, or international cybersecurity expectations for connected medical devices.

Question 6

How often are new episodes released?

Accepted Answer

New episodes drop weekly. Subscribe on YouTube, Apple Podcasts, Spotify, or via RSS so you don't miss a release.

Question 7

What is the FDA 524B eSTAR template?

Accepted Answer

Section 524B of the FD&C Act made cybersecurity a statutory requirement for cyber devices. The eSTAR template is the FDA's interactive PDF that walks submitters through every required cybersecurity artifact - from the SPDF and threat model to the SBOM and postmarket plan - before the submission is accepted for review.

Question 8

What is the difference between 510(k), De Novo, and PMA cybersecurity expectations?

Accepted Answer

The same 524B cybersecurity artifacts apply across pathways, but rigor scales with risk class. Class II 510(k) submissions need a documented SPDF, threat model, SBOM, and security testing. De Novo submissions add justification for novel mitigations. PMA submissions for Class III devices typically demand deeper architectural review, more comprehensive penetration testing, and stronger postmarket commitments.

Question 9

Do I need penetration testing for my FDA submission?

Accepted Answer

Yes for any cyber device. The FDA expects independent penetration testing covering the device, its wireless/network interfaces, mobile apps, cloud back ends, and supply chain. The report should be reproducible, traceable to the threat model, and accompanied by remediation evidence.

Question 10

What standards apply to medical device cybersecurity?

Accepted Answer

Core standards include AAMI TIR57 and TIR97 (cybersecurity risk and postmarket management), IEC 81001-5-1 (security activities for the product life cycle), ISO 14971 (risk management), IEC 62304 (software life cycle), and the ANSI/UL 2900 series. The FDA references most of these in its premarket and postmarket guidance.

Question 11

What is a Secure Product Development Framework (SPDF)?

Accepted Answer

An SPDF is a documented set of processes that integrate security activities into every phase of the product life cycle - requirements, design, implementation, verification, release, and postmarket. The FDA expects manufacturers to demonstrate an SPDF in premarket submissions.

Question 12

How does postmarket cybersecurity management work?

Accepted Answer

Postmarket cybersecurity management includes monitoring SBOM components for new vulnerabilities, running a coordinated vulnerability disclosure (CVD) program, deploying validated patches, communicating with operators, and reporting to the FDA when patient harm is plausible. Section 524B made the postmarket plan a premarket gate.

Question 13

What is coordinated vulnerability disclosure (CVD)?

Accepted Answer

CVD is a published process that lets independent researchers report vulnerabilities to the manufacturer privately, gives the manufacturer time to remediate, and then coordinates public disclosure. The FDA strongly recommends a CVD program for every cyber device, aligned with ISO/IEC 29147 and 30111.

Question 14

How does AI/ML change medical device cybersecurity?

Accepted Answer

AI/ML adds new attack surface (model theft, adversarial inputs, training-data poisoning) and new failure modes (drift, hallucination). The FDA's predetermined change control plan (PCCP) framework and the 2024 AI/ML guidance require manufacturers to bake security and integrity controls into the model life cycle, not just the software around it.

Question 15

What is IEC 62304 and how does it relate to cybersecurity?

Accepted Answer

IEC 62304 defines the medical device software life cycle. Amendment 1 explicitly requires cybersecurity activities - risk analysis, secure design, vulnerability management - across software safety classes A, B, and C. Compliance is a foundation that the FDA, EU MDR, and international regulators all build on.

Question 16

What is IEC 62304 and how does it relate to cybersecurity?

Accepted Answer

IEC 62304 defines the medical device software life cycle. Amendment 1 explicitly requires cybersecurity activities - risk analysis, secure design, vulnerability management - across software safety classes A, B, and C. Compliance is a foundation that the FDA, EU MDR, and international regulators all build on. In practice we map 62304 deliverables (software development plan, architecture, unit/integration/system testing, problem resolution) directly into the SPDF so a single set of artifacts satisfies both the safety and security reviewers.

Question 17

How do EU MDR and IVDR cybersecurity requirements compare to the FDA?

Accepted Answer

EU MDR Annex I (sections 17.2 and 17.4) and IVDR Annex I (16.4) require manufacturers to set minimum requirements for IT environment, hardware, networks, and security controls - operationalized through MDCG 2019-16. The expected artifacts (threat model, risk assessment, SBOM, verification, postmarket surveillance) overlap heavily with FDA Section 524B, but EU notified bodies emphasize state-of-the-art justification, residual risk acceptance, and integration with the broader QMS under ISO 13485.

Question 18

How do NIS2, the EU Cyber Resilience Act, and HIPAA affect medical device makers?

Accepted Answer

NIS2 raises baseline security and incident-reporting duties for essential and important entities, including many MedTech manufacturers and the hospitals that deploy their devices. The Cyber Resilience Act adds product-level security requirements and vulnerability handling for any product with digital elements sold in the EU. In the U.S., HIPAA governs PHI handled by the device or its cloud back end. Together they create overlapping reporting clocks (24/72 hours, 60 days) that need to be wired into your incident response plan, not just legal review.

Question 19

How do we secure legacy medical devices that can't be redesigned?

Accepted Answer

Legacy devices rarely tolerate firmware changes, so security shifts to compensating controls: network segmentation and zero-trust microsegmentation, allowlisting at hospital boundaries, MDS2 disclosures so operators understand the risk, monitored remote access, and a clear end-of-support communication plan. The FDA still expects a coordinated vulnerability disclosure program and timely patches when feasible, even for devices designed before 524B existed.

Question 20

What goes into securing cloud and mobile components of a connected device?

Accepted Answer

Cloud back ends and companion mobile apps are in scope for FDA cybersecurity review whenever they affect device safety or essential performance. Expect threat modeling of trust boundaries, hardened tenancy and IAM, encrypted transport and storage, secrets management, signed firmware/OTA pipelines, runtime monitoring, and penetration testing of the API surface and mobile binary. The SBOM should cover container images and mobile dependencies, not just the device firmware.

Question 21

How do we respond to an FDA cybersecurity deficiency letter?

Accepted Answer

Deficiency letters typically cite a missing or thin SPDF, threat model gaps, weak SBOM analysis, or insufficient postmarket plans. The fastest path to clearance is a structured response: map each deficiency to a remediation, regenerate the affected artifact (not a one-paragraph justification), update the threat model and risk assessment for traceability, and resubmit with a change log the reviewer can follow. Blue Goat Cyber regularly turns these around in days rather than weeks.

Question 22

How long does cybersecurity work add to an FDA submission timeline?

Accepted Answer

When security is built in from design, the cybersecurity package typically adds 4-8 weeks of effort in parallel with other submission work. Bolted on at the end, it can extend timelines by 3-6 months because threat models, SBOMs, and pen tests often surface design changes. Listening to the podcast and engaging early - ideally at requirements or architecture - is the single biggest lever on schedule.

Question 23

Can I submit guest topics or be a guest on the podcast?

Accepted Answer

Yes. Use the guest pitch form at the bottom of the podcast page. We prioritize practitioners with first-hand stories - submission wins and rejections, vulnerability disclosure experiences, hospital integration lessons, AI/ML rollouts - over vendor pitches. Episodes are recorded remotely and run roughly 30-45 minutes.

Question 24

Where can I get help applying what I hear on the podcast?

Accepted Answer

Blue Goat Cyber's team supports MedTech manufacturers across the full life cycle - premarket submissions, threat modeling, penetration testing, SBOM and supply-chain monitoring, postmarket vulnerability management, and rapid response to FDA cybersecurity deficiency letters. Book a discovery session from the podcast page or the contact form, and we'll scope the right engagement for where you are in the product life cycle.

The Med Device Cyber Podcast - candid conversations on medical device cybersecurity.

Latest episode

Can We Detect Skin Cancer Without a Biopsy? with Stefan Mazy

All episodes

The Commercialization Gaps MedTech Founders Keep Missing with Ryan Roghaar

Why the Best MedTech Candidates Aren’t Applying to Your Jobs with Darwin Shurig

The Hidden Barriers to Clinical Adoption with Amel Havkic

Why Technical Intelligence Is Not Enough with Samantha Silk

Productivity, Psychological Safety and AI with Sarah Ohanesian and Jeff Gibbard

From Science Fiction to Visual Prosthesis with Frederik Ceyssens

Building Medical Devices Right the First Time with Helen Souris

What MedTech Can Learn from the Casino Industry with Melissa Aarskaug

The Future of Cardio-Oncology Wearables with Ryan Neely

Navigating U.S. Market Entry for MedTech Developers with JJ Amell

The Psychology of Medical Device Security Awareness with Shahbaz Ahmed

The Age of Digital Health Humanity with Philippe Gerwill

What we cover

Jump to what matters for your role.

MedTech cybersecurity, answered.

Bring this rigor to your next FDA submission.

Know someone listeners need to hear from?