Seven questions mapped to the FDA's Feb 3, 2026 final premarket cybersecurity guidance. Get a score, a domain-by-domain gap list, and the fastest next move.
Reviewed by
Christian Espinosa
Founder & CEO, Blue Goat Cyber
What you'll see after you submit
Common misconceptions
Myth: A high readiness score guarantees first-cycle clearance.
Reality: This quiz is a fast pulse-check. Reviewers still scrutinize artifacts. Use the SPDF Gap Checker and eSTAR Cybersecurity Checklist for artifact-level coverage.
Myth: If our QMS passes ISO 13485, our cyber readiness is fine.
Reality: ISO 13485 / QMSR set the lifecycle; §524B and the Feb 2026 guidance add specific cyber artifacts (SBOM, CVD, threat model, postmarket plan) that QMS audits don't validate.
Myth: Cybersecurity readiness is a one-time premarket check.
Reality: The FDA expects readiness to be maintained across the TPLC. Re-take this every release cycle and after any architecture or component change.
References & further reading
Tracked signals that change what reviewers expect. Items move on as new ones land.
Each readiness dimension maps to a dedicated service. Start with the lowest-scoring areas first.
Documented STRIDE-based threat model traceable to your design inputs.
Read Threat modeling for medical devicesSPDX/CycloneDX SBOMs with continuous CVE and KEV mapping.
Read Medical device SBOM servicesIndependent exploit-driven testing across device, wireless, USB, and cloud paths.
Read Medical device penetration testingFull SPDF + eSTAR-ready submission package aligned to current FDA guidance.
Read FDA premarket cybersecurityVulnerability monitoring, CVD, patch validation, and FDA reporting workflows.
Read Postmarket cybersecurity programQuantify what every week of submission slip costs in revenue and gross profit.
Read Cost-of-delay calculator