eSTAR cybersecurity documentation for medical devices

Blue Goat prepares the agreed cybersecurity documentation mapped to applicable eSTAR fields. The work connects threats, patient-harm risks, controls, and testing evidence. Your regulatory team reviews and submits the eSTAR. Fixed fee after scoping.

What Blue Goat prepares

• Threat model and cybersecurity risk assessment, traced to the manufacturer's ISO 14971 safety risk file
• SBOM generation and enrichment with support level and end-of-support data
• Security architecture views
• Penetration testing as independent third-party reports. See what a Blue Goat penetration test report contains.
• Cybersecurity labeling content and management plan input
• Coordinated vulnerability disclosure support
• Cybersecurity questions and supporting material for a Pre-Submission, prepared in FDA's PreSTAR template

The statement of work identifies which documents need to be created, updated, or supported by additional security testing. Your manufacturer team retains engineering changes, risk acceptance, general software verification and validation, and QMS approval. The FDA makes the regulatory decision.

Documentation support or the broader package?

Discuss eSTAR documentation support when you need to prepare or update the cybersecurity attachments for your submission. Existing records and testing evidence determine what work is needed. This is not a separate regulatory pathway or a promise that every document applies to your device.

Choose the FDA Premarket Cybersecurity Package when you need the broader documentation and security activities coordinated in one engagement. Choose Medical Device Penetration Testing when the gap is testing evidence. We agree any additional documentation or testing before work begins.

What eSTAR is

eSTAR is the FDA's electronic submission template, an interactive PDF. It is required for 510(k) and De Novo submissions to CDRH and CBER, unless exempted. The FDA publishes separate templates for non-IVD devices, IVD devices, and early requests such as Q-Submissions. The template checks for completeness, so a missing item can stop a submission from being accepted for review.

For a new submission, use the FDA's current template where practicable. Relevant changes in an older major version may prompt additional information requests; older minor versions typically do not. After the FDA acknowledges your submission, update the original eSTAR for Additional Information or technical-screening responses rather than switching versions.

For what changed in the current template, see the eSTAR 7.1 submission checklist.

Before the formal submission, manufacturers can use PreSTAR, the FDA's template for Pre-Submission requests, to ask the FDA about their cybersecurity approach early. See PreSTAR vs eSTAR.

eSTAR is voluntary for specified PMA application and supplement types. Applicable cybersecurity guidance recommendations also apply to PMA submissions.

See the FDA eSTAR program for current templates and version instructions.

What the cybersecurity section asks for

Blue Goat's eighteen-item delivery map organizes the work. It is not a list of eighteen universally required FDA documents. Applicability depends on your device and pathway. See the FDA Premarket Cybersecurity Deliverables and eSTAR Map. The work falls into these groups:

• Security risk management. A security risk management report, a threat model, and a cybersecurity risk assessment. Exploitability and patient-harm severity are assessed separately, rather than using probability of an attack.
• Software supply chain. An SBOM, the support level and end-of-support date for each component, a vulnerability assessment, and an assessment of unresolved anomalies.
• Security architecture and controls. Security requirements with control coverage, and security architecture views.
• Testing. Static analysis, plus a penetration test plan, test cases, and test report, as scoped. The FDA's guidance lists five elements for a penetration test report: tester independence and technical expertise, scope, duration, methods, and results with findings and observations.
• Labeling. Cybersecurity labeling for users. A Manufacturer Disclosure Statement for Medical Device Security (MDS2) is an optional procurement disclosure, not an FDA or eSTAR requirement.
• Management. A cybersecurity management plan for postmarket vulnerability handling.
• Interoperability and metrics. An interoperability risk assessment, interoperability labeling, and measures and metrics.

What the law requires and what the guidance recommends

For a cyber device, section 524B(b) of the FD&C Act requires three things: a plan to monitor, identify, and address postmarket cybersecurity vulnerabilities and exploits, including coordinated vulnerability disclosure; processes that provide a reasonable assurance that the device and related systems are cybersecure; and a software bill of materials covering commercial, open-source, and off-the-shelf components.

The FDA's February 3, 2026 premarket cybersecurity guidance describes recommended supporting documentation. The depth of that documentation scales with the device's cybersecurity risk.

Where submissions come apart

The documents have to agree with each other. The FDA's guidance names traceability as a documentation element. A threat in the threat model should lead to a risk, a control, a test, and a residual risk. When one link breaks, a reviewer cannot follow the chain.

The 510(k) penetration testing for an AI-enabled cloud SaMD case study illustrates testing scope and evidence. It is not an example of a complete eSTAR documentation engagement.

What to bring to the scoping call

• Submission pathway, planned submission date, and the eSTAR version in use.
• Device architecture, intended use, and connected components.
• Existing threat model, cybersecurity risk assessment, SBOM, and testing records, where available.
• Known evidence gaps and any cybersecurity correspondence from the FDA.

Identify missing inputs during the call. Agree secure document sharing before sending confidential device material.

How an engagement runs

1. Scoping. A signed statement of work names the pathway, the device architecture, and the deliverable set.
2. Risk analysis. Asset inventory, threat model, and risk assessment.
3. Security testing. The applicable testing categories in the FDA's guidance, within the agreed scope.
4. SBOM production. Minimum elements first, then support level and end-of-support enrichment.
5. Release. Every deliverable passes an internal Blue Goat quality review before it ships.

Fixed fee after scoping. The proposal records deliverables, assumptions, manufacturer inputs, and dates. Device access, engineering fixes, and review feedback can affect the schedule. Quote turnaround is separate from delivery time.

Frequently asked questions

275+ FDA submissions supported, zero cybersecurity rejections.

Discuss your eSTAR documentation scope

Review the evidence you have, the work still needed, and your regulatory team's handoff requirements.