Blue Goat Cyber^SMMedical Device Cybersecurity

Where are you right now?

Designing the device

We need security built in before the FDA asks for it.

Medical Device Threat Modeling
Secure MedTech Product Design

Getting ready to submit

We need a complete, FDA-ready cybersecurity package.

Full-Service FDA Premarket Cybersecurity
Medical Device Penetration Testing
FDA-Compliant SBOM Services

Got an FDA deficiency letter

The FDA flagged our cybersecurity and the clock is ticking.

FDA Deficiency Response

Passing hospital security reviews

Hospitals won't buy until we pass their security review.

MedTech Compliance Bundle
HIPAA Penetration Testing

Already on the market

We need to stay compliant and handle new vulnerabilities.

FDA Postmarket Cybersecurity
MedTech Cybersecurity Advisory
Legacy Device Protection

Investors and acquirers

We need to know if the target's cybersecurity will hold up with the FDA.

Cybersecurity Due Diligence

Not sure? Answer two questions See all services

Readiness quiz2-min score Scope estimatorTest-day range Cost of delayROI calc

Blue Goat products

GoatWatchSBOM risk management for medical devices

Learn

Blog
Podcast
Webinars
Talks & workshops
Glossary
FAQs

Playbooks & Tools

Guides
Playbooks (PDF)
Infographics
Interactive Tools

Signals & Proof

Goat FeedNew
News
Medical Device Security News
The Goat's Weekly
Case Studies
Proof / Receipts

All resources, topic hubs, & collections →

Book Strategy Session How to prepare →

Refuse to accept vs. hold letter vs. deficiency letter

All infographics

FDA Regulation

Refuse to accept vs. hold letter vs. deficiency letter

What each FDA letter means, when it arrives, how long you have to respond, and what to do next.

All three letters carry a 180-day window. Miss it and the submission is withdrawn.

Download the graphic Talk through it with us

What the graphic says

The full text version, so the content is readable without the image.

Refuse to accept (or eSTAR technical screening hold)

When: First 15 calendar days after the FDA receives the submission.
What it means: The submission is incomplete and review has not started.
Response clock: 180 days to send a complete submission, or it is withdrawn.
Next step: Add every missing element and resubmit.

Hold letter (510(k) additional information request)

When: During substantive review.
What it means: The reviewer has questions and the 510(k) is placed on hold.
Response clock: 180 calendar days to respond in full, or the 510(k) is considered withdrawn.
Next step: Answer each question with evidence, not promises.

Deficiency letter (De Novo or PMA)

When: During substantive review.
What it means: Major questions on a De Novo request or PMA.
Response clock: 180 days to respond in full, or the submission is considered withdrawn.
Next step: Answer each deficiency with evidence.

Sources: FDA Refuse to Accept Policy for 510(k)s guidance, FDA eSTAR program, and FDA guidance on additional information requests.

Keep reading

FDA deficiency letter vs. RTA vs. hold
The 180-day response timeline
Deficiency response playbook

More in FDA Regulation

Infographic timeline: October 2014 first premarket guidance; December 28, 2016 postmarket guidance; December 29, 2022 Section 524B enacted; March 29, 2023 Section 524B in effect; September 27, 2023 premarket guidance; October 1, 2023 refuse-to-accept begins; June 27, 2025 updated premarket guidance; February 3, 2026 current premarket guidance.

FDA medical device cybersecurity timeline, 2014 to 2026

Infographic listing ten eSTAR cybersecurity documents: threat model, security risk assessment, security architecture views, SBOM, unresolved anomalies, cybersecurity testing, traceability, cybersecurity management plan, labeling, and risk management report.

What goes in the eSTAR cybersecurity section

Infographic with four cards: postmarket vulnerability plan with coordinated disclosure, secure design processes with updates and patches, SBOM, and other requirements the FDA sets by regulation, each paired with its evidence.

Section 524B checklist for cyber devices

Two-column infographic. Premarket, under the February 2026 guidance and Section 524B: threat model, architecture views, SBOM, testing, unresolved anomalies, labeling, postmarket plan. Postmarket, under the December 2016 guidance and Section 524B: monitoring, coordinated disclosure, controlled vs. uncontrolled risk, patching, out-of-cycle fixes, ISAO sharing, and FDA reporting when required.

Premarket vs. postmarket cybersecurity duties

Ready when you are

Get FDA cleared without the cybersecurity headaches.

30-minute strategy session. No cost, no commitment - just answers from people who've shipped 275+ devices supported.

Book strategy session Explore services

Full-service medical device cybersecurity. We protect patients and accelerate FDA clearance for connected medical devices.

275+ Devices Supported · Mission: 1,000 by 2028

SDVOSB · Service-Disabled Veteran-Owned Small Business

We sponsor 10 community projects →

Services

Full-Service FDA Premarket Cybersecurity
FDA Deficiency Response
Medical Device Threat Modeling
Medical Device Penetration Testing
FDA Postmarket Cybersecurity
All services →

Services

Full-Service FDA Premarket Cybersecurity
FDA Deficiency Response
Medical Device Threat Modeling
Medical Device Penetration Testing
FDA Postmarket Cybersecurity
All services →

Company

About
Core values
Manifesto
Leadership
Why Us
Partners
Careers
Press
Contact
Company overview PDF

Company

About
Core values
Manifesto
Leadership
Why Us
Partners
Careers
Press
Contact
Company overview PDF

Resources

Blog
Guides
Podcast
Case studies
Monthly Pulse newsletter
All resources →

Resources

Blog
Guides
Podcast
Case studies
Monthly Pulse newsletter
All resources →

Get in touch

info@bluegoatcyber.com
844-939-GOAT
Book a strategy session →
1776 N Scottsdale Rd, Unit 727
Scottsdale, AZ 85257Serving clients worldwide

Follow

© 2026 Blue Goat Cyber. All rights reserved.

Privacy
Terms
Cookies
Sitemap
Accessibility
CVD

MedTech Cybersecurity · Since 2022