FDA Postmarket CybersecuritySBOM Monitoring, CVD, & Ongoing Compliance for Cleared Devices.

SBOM monitoring runs continuously. Every component in your device SBOM is matched against the NVD, CISA KEV catalog, GitHub Advisory Database, and vendor advisories on a daily cycle, with new CVE disclosures flagged within 24 hours of publication. Each flag is triaged in device context - exploitability against your specific architecture, patient-harm impact under ISO 14971, and whether the component is actually reachable in your deployed configuration. You receive a prioritised alert with a recommended action (patch, VEX statement, or no-action justification) rather than a raw CVE feed your team has to interpret.

We operate the full CVD lifecycle on your behalf. A published security.txt and disclosure inbox give researchers a single point of contact. When a report arrives, a senior engineer triages within one business day, validates the finding against your device, and coordinates a fix timeline with your engineering team. We draft the public advisory, prepare any customer communication and FDA reporting within the FDA's postmarket timelines, align with the researcher on coordinated release, and publish the advisory and VEX statement. The entire interaction is logged for audit.

FDA postmarket cybersecurity obligations under Section 524B and EU MDR Annex I postmarket surveillance requirements overlap but are not identical - EU MDR places greater weight on the periodic safety update report (PSUR) and notified-body interaction, while FDA emphasises SBOM maintenance and timely vulnerability communication and remediation. Our annual engagement can be scoped to cover both: a single underlying monitoring program produces FDA-aligned advisories and notifications plus the PSUR-ready cybersecurity sections your notified body expects. Dual-market manufacturers avoid running two parallel processes.

Three conditions trigger patch validation. First: a new CVE affecting a SBOM component where the upstream fix needs to be integrated and verified against your device. Second: a manufacturer-initiated fix - a security improvement or feature change that touches the cybersecurity controls. Third: a regulatory notification, such as a CISA advisory or FDA safety communication that names a component in your stack. Each patch goes through regression testing against the threat model, targeted security retesting on the affected interfaces, and documentation updates so the change is traceable in your design history file.

Section 524B(b) places three ongoing obligations on cyber device manufacturers: maintain processes to monitor, identify, and address postmarket cybersecurity vulnerabilities and exploits including coordinated vulnerability disclosure; provide updates and patches on a reasonably justified regular cycle, and out-of-cycle for critical vulnerabilities; and maintain a current SBOM. FDA's 2026 guidance translates these into specific evidence: documented CVD program, vulnerability triage SLAs, change-controlled patch delivery process, and a maintained SBOM with VEX statements. Our engagement covers all three obligations as inspectable QMS records.

Yes - premarket cybersecurity work ends at clearance, but Section 524B obligations begin at clearance and continue for the device's entire commercial life. Postmarket is structurally an annual recurring engagement, not a project. Typical annual cost depends on device fleet size, SBOM component count, and whether you want full CVD program operation or just monitoring with internal triage. Most single-device manufacturers run mid-five-figures annually; multi-device platforms scale from there. The fee is fixed per year - no per-CVE charges, no incident surcharges.

It depends on the risk. Under the FDA's postmarket cybersecurity guidance, a vulnerability with controlled risk can usually be fixed as a routine update without reporting to the FDA. For an uncontrolled risk to patients, the manufacturer is expected to communicate with customers within 30 days of learning of it and fix it within 60 days. If you meet those timelines and take part in an information sharing organization, a correction and removal report under 21 CFR Part 806 is generally not required. Otherwise a report is due within 10 working days of starting the correction. We run that risk assessment with you, draft the customer and FDA communications, and track every deadline inside the engagement.

GoatWatch is the operational backbone of the engagement: continuous SBOM ingestion, daily CVE matching across NVD, CISA KEV, GitHub Advisory, and vendor advisories, device-context triage that filters noise (a CVE in an unused library function is not actioned the same as a CVE on the firmware update path), VEX statement generation, and dashboard reporting for your QMS audit trail. The difference from a raw CVE feed: every flag is paired with engineering judgement on exploitability and patient impact, so your team responds to actionable items, not a wall of CVSS scores.

Patch development stays with your engineering team, because the code, the build pipeline, and the design history file all live with you. Our scope covers everything around the patch: identifying the vulnerability, recommending a remediation approach, validating the fix against the threat model, security retesting on affected interfaces, updating SBOM and VEX statements, drafting the patch advisory, and the FDA notification if required. This split keeps software ownership where it belongs while giving you cybersecurity expertise on the regulated side.

Legacy devices are common - many cleared before SBOM expectations existed. We build a current-state SBOM from the deployed firmware (using binary SCA, source analysis, and supply chain reconstruction), reconstruct a threat model from the as-built architecture, and stand up the same monitoring and CVD process used for new devices. The result is FDA-defensible postmarket evidence even when the original submission predates Section 524B. Our Legacy Device Cybersecurity service handles devices that need this groundwork before postmarket monitoring can begin.

An active incident triggers our incident response process: a senior engineer is on a call with your team within one business day (sooner for confirmed exploits in the wild), we coordinate containment, evidence preservation, and clinical-impact assessment, draft customer and FDA communications within the FDA's postmarket timelines if the risk is uncontrolled, and lead the postmortem and corrective action documentation that satisfies QMS CAPA requirements. The annual engagement covers a defined number of incident hours; sustained major incidents may require a separate scope but are billed against published rates with no surprise pricing.

Yes - that's the design intent. Each quarterly report documents every monitored component, every CVE flagged and triaged, every disposition decision (patch, VEX, no-action with justification), every patch deployed, every CVD interaction, and every FDA notification. The report is structured as an inspectable QMS record under your existing 21 CFR 820 / ISO 13485 framework. During an inspection or 483 follow-up, the quarterly reports plus the monitoring dashboard give an investigator a complete chain of custody for postmarket cybersecurity decisions - without requiring your team to reconstruct anything from scratch.