eSTAR Cybersecurity Section Checklist

Cybersecurity cover-letter section mapping each §524B artifact to its eSTAR location

Cover Letter · Reviewers triage by cover letter; a missing map = AI request.

Cybersecurity section of the IFU: intended environment, user responsibilities, security update process

Labeling (IFU) · Required for §524B-eligible devices and any networked device.

Completed MDS² (Manufacturer Disclosure Statement for Medical Device Security)

Labeling · Hospital procurement and reviewers both expect this.

ISO 14971 risk file with cybersecurity hazards linked to threat model

Risk Analysis · Cyber risk must roll into the device risk file, not live separately.

STRIDE or PASTA threat model with traceability to interfaces, assets, and controls

Cybersecurity - Threat Model · AAMI TIR57 / SW96 aligned - the #1 deficiency-letter trigger.

Security architecture views: data flow, trust boundaries, interfaces, third-party components

Cybersecurity - Architecture · Reviewers need a picture before they read controls.

Security controls table mapped to threats, with verification evidence per control

Cybersecurity - Controls · 'We use TLS' is not a control; the mapping is the control.

Machine-readable SBOM (SPDX 2.3+ or CycloneDX 1.5+) covering all components incl. transitive + OS

Cybersecurity - SBOM · Statutory under §524B.

VEX statements (or equivalent) for known CVEs in the SBOM

Cybersecurity - SBOM · Without VEX, every CVE looks open.

Independent penetration test report with CVSS-rated findings and remediation evidence

Cybersecurity - Testing · Reviewers expect third-party, not internal-only, testing.

Fuzz and abuse-case testing evidence for interfaces and parsers

Cybersecurity - Testing · Required for cyber devices, called out in 2026 guidance.

Postmarket monitoring & patching plan with SLAs by severity

Cybersecurity - Postmarket · Statutory under §524B.

Published Coordinated Vulnerability Disclosure (CVD) policy + security contact

Cybersecurity - Postmarket · Statutory under §524B; reviewers will check the URL.

Secure software update mechanism description (signing, rollback, customer notification)

Cybersecurity - Postmarket · Must show how patches actually reach the field safely.

PCCP that explicitly covers cybersecurity impact of authorized changes

Cybersecurity - AI/ML (if applicable) · AI/ML modifications can change attack surface; PCCP must address it.

Traceability matrix: requirement → threat → control → verification

Cybersecurity - Traceability · Most efficient way to pre-empt deficiency questions.