eSTAR Cybersecurity Section Checklist

Cybersecurity cover-letter section mapping each §524B artifact to its eSTAR location

Cover Letter · Reviewers triage by cover letter; a missing map = AI request.

Cybersecurity section of the IFU: intended environment, user responsibilities, security update process

Labeling (IFU) · Required for §524B-eligible devices and any networked device.

Completed MDS² (Manufacturer Disclosure Statement for Medical Device Security)

Labeling · Hospital procurement and reviewers both expect this.

ISO 14971 risk file with cybersecurity hazards linked to threat model

Risk Analysis · Cyber risk must roll into the device risk file, not live separately.

STRIDE or PASTA threat model with traceability to interfaces, assets, and controls

Cybersecurity - Threat Model · AAMI TIR57 / SW96 aligned - the #1 deficiency-letter trigger.

Security architecture views: data flow, trust boundaries, interfaces, third-party components

Cybersecurity - Architecture · Reviewers need a picture before they read controls.

Security controls table mapped to threats, with verification evidence per control

Cybersecurity - Controls · 'We use TLS' is not a control; the mapping is the control.

SBOM covering commercial, open-source, and off-the-shelf software components

Cybersecurity - SBOM · SBOM is statutory under §524B(b)(3); machine-readable formats are recommended without a version floor.

Device-specific vulnerability applicability, risk, and disposition assessment

Cybersecurity - SBOM · VEX may communicate the assessment, but is optional and not an FDA-required artifact.

Independent penetration test report with CVSS-rated findings and remediation evidence

Cybersecurity - Testing · Document tester independence and expertise, scope, duration, methods, results, and manufacturer assessment. Independent internal testers may be appropriate.

Fuzz and abuse-case testing evidence for interfaces and parsers

Cybersecurity - Testing · Recommended within vulnerability testing, where appropriate to interfaces and risks; not a separately mandated report.

Postmarket vulnerability plan and justified regular and out-of-cycle patch processes

Cybersecurity - Postmarket · Section 524B(b)(1)-(2) establishes these duties for covered cyber devices; it specifies no universal numerical SLA.

Published Coordinated Vulnerability Disclosure (CVD) policy + security contact

Cybersecurity - Postmarket · Statutory under §524B; reviewers will check the URL.

Secure software update mechanism description (signing, rollback, customer notification)

Cybersecurity - Postmarket · Must show how patches actually reach the field safely.

Traceability matrix: requirement → threat → control → verification

Cybersecurity - Traceability · Most efficient way to pre-empt deficiency questions.