Why this matters
On Feb 3, 2026 the FDA finalized its updated guidance, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions. It supersedes the Sept 27, 2023 version. Submissions filed after that date are reviewed against a higher, more specific bar - especially for SPDF evidence, SBOM machine-readability, and threat modeling rigor.
Key takeaway: If your last submission was before Feb 2026, your existing cybersecurity package is almost certainly out of date in at least three places. Plan a gap review before re-submitting.
What is a 'cyber device' under Section 524B?
Section 524B of the FD&C Act defines a cyber device as one that (a) includes software validated, installed, or authorized by the sponsor as a device or in a device, (b) has the ability to connect to the internet, and (c) contains technological characteristics that could be vulnerable to cybersecurity threats. The 2026 guidance reaffirms the FDA's broad reading of (b) - Bluetooth, cellular, USB tethered to a connected host, and offline devices that periodically sync all qualify.