Threat Model
Guidance evidence
Data flows, trust boundaries, attack paths, and Threat Table. Architecture views are separately scoped.
Tools
Premarket cybersecurity timeline
Plan your cybersecurity evidence around your submission target. Dates are yours, not Blue Goat delivery commitments or the FDA's review schedule.
This uses Blue Goat's deliverable framework, with additional process, retest, and handoff milestones. It is not a universal FDA checklist. Evidence can share documents. Applicability and scope need manufacturer review. Section 524B duties are separate from guidance recommendations.
0 / 21
Deadlines assigned
0
Marked complete
0
Date conflicts
Entries stay in this page's memory and disappear on refresh. Nothing is saved to an account or sent with the export.
1
Design and risk
Cybersecurity Risk Assessment
Guidance evidence
Exploitability, security impact, patient-harm context, controls, and manufacturer risk decisions.
Security Requirements and Control Coverage
Guidance evidence
Implemented controls linked to threats, requirements, and test evidence.
Security Architecture Views
Guidance evidence
Global System, Multi-Patient Harm, Updateability/Patchability, and Security Use Case views.
Interoperability Risk Assessment
As applicable
External-system dependencies, interfaces, data integrity, failure conditions, and security controls. General software V&V remains with the manufacturer.
2
Software evidence
Software Bill of Materials (SBOM)
Section 524B(b)(3), when applicable
Inventory of actual software in the identified configuration. Blue Goat uses SPDX by default.
Component Support and End-of-Support
Guidance evidence
Component support status, end-of-support information, and vulnerability assessment. Unknown information stays explicit.
Static Application Security Testing (SAST)
Scoped security testing
Source-analysis findings and human-reviewed dispositions tied to the assessed version and available evidence.
3
Testing and remediation
Penetration Testing: Test Plan
Guidance evidence
Scope, threat mapping, methods, tools, test configuration, rules of engagement, and tester independence.
Penetration Testing: Test Cases
Guidance evidence
Test points, threats, steps, and expected secure behavior with traceability.
Penetration Testing: Test Report
Guidance evidence
Methods, duration, findings, clean results, limitations, remediation, and patient-impact distinctions.
Assessment of Unresolved Anomalies
Guidance evidence
Security implications of unresolved anomalies, controls, and manufacturer residual-risk disposition.
Remediation and Retest Records
When findings or changes require it
Engineering fixes, security retests, and updates to affected evidence. Fixes and risk acceptance belong to the manufacturer.
4
Lifecycle documentation
Cybersecurity Labeling
Guidance evidence
Security capabilities, supported configurations, update support, and user/manufacturer responsibilities.
Interoperability Labeling
As applicable
Supported connections, interface constraints, and responsibilities consistent with the assessed system.
MDS2
Optional procurement disclosure
Customer security disclosure when requested. Not an FDA or eSTAR requirement.
Cybersecurity Management Plan
Section 524B(b)(1), when applicable
Monitoring, vulnerability intake, coordinated disclosure, triage, updates, and communications.
Measures and Metrics
Guidance evidence
Defined process measures and available observed results. Do not invent field history or patch deadlines.
Cybersecurity Processes and Procedures
Section 524B(b)(2), when applicable
Development and maintenance processes, including updates and patches. The plan and SBOM do not replace this duty.
5
Review and handoff
Risk Management Report
Guidance evidence
The evidence summary, traceability, unresolved issues, and manufacturer risk decisions.
Final Traceability Review
Guidance evidence
Connect threats, requirements, controls, tests, findings, and dispositions. May be part of the risk report.
Submission Evidence Index and Manufacturer Review
Submission planning
Document revisions, attachment references, scope gaps, and manufacturer approval. Use the applicable submission format; eSTAR 7.1 where applicable.
Review the scope before agreeing dates
Device access, source and build evidence, engineering fixes, retests, and manufacturer review affect dates. Work can overlap. Blue Goat provides cybersecurity documentation and security testing, not general software V&V. The manufacturer owns submission and risk decisions.
Source: the FDA's February 3, 2026 premarket cybersecurity guidance. Check the applicable eSTAR template and submission instructions.